Saint CitrixBleed 2, Who Bled Memory Again

Patron of NetScaler gateways, stolen sessions, and security déjà vu.

Life

In June 2025 a fresh flaw in NetScaler ADC and Gateway (CVE-2025-5777), dubbed CitrixBleed 2 by Kevin Beaumont, repeated the 2023 story: a device that, when queried, handed back pieces of its own memory, session tokens among them. With those an attacker logged in without a password and without a second factor. It soon joined CISA's exploited vulnerabilities, proving that some lessons have to be learned twice.

Prayer

O Saint CitrixBleed 2, who makes the gateway's memory speak, let our devices not repeat the sins they have already confessed. Amen.

How to celebrate

Celebrated by updating NetScaler, terminating active sessions after patching, and rereading the 2023 advisory so as not to relive it in 2027.

An old wound reopened brings a familiar surprise.