Researchers Warn of Likely Exploitation as Citrix Denies Active Attacks
Signs of Active Exploitation
Despite Citrix’s assertion that there is “no evidence to suggest exploitation,” researchers and analysts are raising alarms. ReliaQuest now assesses with medium confidence that attackers are actively leveraging the flaw for initial access, citing several red flags from recently observed attacks:
- Session hijacking: Citrix sessions were observed continuing across both legitimate and attacker-controlled IP addresses, indicating token theft and MFA bypass.
- Active Directory reconnaissance: Attackers initiated LDAP queries and ran tools like ADExplorer64.exe to map out users, groups, and domain permissions post-access.
- Anonymized infrastructure: Traffic originated from VPN services and data center IPs linked to providers like DataCamp, suggesting attacker obfuscation techniques.
These findings strongly align with known post-exploitation tactics, supporting concerns that CVE-2025-5777 is being actively exploited.
Mitigation and Guidance
Citrix customers are urged to immediately upgrade to a fixed version to remediate the vulnerability:
- 14.1-43.56+
- 13.1-58.32+
- 13.1-FIPS/NDcPP 13.1-37.235+
Additionally, Citrix’s advisory recommends that administrators end all active ICA and PCoIP sessions after patching to prevent attackers from maintaining access via stolen session tokens. Before terminating sessions, Citrix advises using the following commands to inspect for anomalies:
show icaconnection- Check under NetScaler Gateway > PCoIP > Connections
To kill active sessions:
kill icaconnection -allkill pcoipconnection -all
For organizations unable to patch immediately, Citrix recommends limiting external access to vulnerable services using firewall rules or network ACLs.
Related Flaw Causes Denial-of-Service
Citrix has also confirmed that another vulnerability, CVE-2025-6543, is actively being exploited to cause denial-of-service (DoS) conditions on NetScaler devices. While this flaw resides in the same module as Citrix Bleed 2, the company stresses they are distinct issues.
Organizations relying on Citrix products should act swiftly to patch and monitor for unusual access patterns, as attackers seem to already be exploiting these vulnerabilities.
