Citrix Bleed 2 (CVE-2025-5777): memory overread on NetScaler gateways

What happened

On 17 June 2025, Citrix disclosed CVE-2025-5777, an insufficient-input-validation flaw leading to memory overread on NetScaler configured as Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Nicknamed Citrix Bleed 2, it echoed the original 2023 Citrix Bleed session-hijacking disaster.

Like its predecessor, the flaw lets a remote attacker read out-of-bounds memory from the gateway process — memory that routinely contains session tokens and credentials. Citrix's bulletin (CTX691844) rated follow-on session hijacking as the primary risk, and exploitation reporting followed within weeks.

Impact

A stolen gateway session token bypasses MFA entirely: the attacker replays a legitimate user's session into VPN, VDI, or internal apps. For organizations that fronted SAP, Magento admin, or ERP behind NetScaler Gateway, one overread could hand over an authenticated admin session.

Root cause in one paragraph

The gateway parsed attacker-shaped input without validating its length against the actual buffer, so a crafted request made the process return memory past the intended object — memory that belonged to other users' live sessions.

What to do now

• Upgrade NetScaler to the fixed builds (14.1-47.46+, 13.1-59.19+, 13.0-92.31+ per CTX691844).
• Terminate ALL active ICA/PICA and VPN sessions after patching — a patch does not invalidate tokens stolen before it.
• Rotate credentials for accounts that used the gateway, and review for anomalous logins from datacenter ASNs.
• Reduce gateway attack surface: disable unused virtual servers and legacy client support.
• If you lived through Citrix Bleed 1, reuse that runbook — the response shape is the same.

What this means for Magento stores

Many Magento hosting setups put admin and ERP behind a VPN or ADC like NetScaler. A gateway memory leak upstream of Magento defeats every password policy and 2FA module you installed — the attacker never logs in, they wear someone else's session. Patch the edge first, kill sessions second, and monitor admin actions for the two weeks after disclosure.

Sources

• NVD: CVE-2025-5777
• Citrix security bulletin CTX691844
• CISA KEV catalog entry for CVE-2025-5777

Next in this series: CrushFTP takeover (CVE-2025-54309) — /blog/cve-2025-crushftp-54309