CVE-2025-5777Active Exploitation(citrix / netscaler_application_delivery_controller)

⚠️ We are observing an active exploitation campaign targeting Citrix NetScaler instances We have observed 500+ exploit attempts of both CitrixBleeds (CVE-2025-5777 and CVE-2023-4966) against our NetScaler decoys across multiple regions: 193.24.211.86 AS215929 🇧🇬 Data Campus Limited 173.164.73.25 AS7922 🇺🇸 Comcast Cable Communications 91.92.243.126 AS202412 🇳🇱 Omegatech LTD 194.31.223.238 AS215439 🇩🇪 PLAY2GO INTERNATIONAL LIMITED Highly elevated exploit activity against older vulnerabilities can often precede a zero-day vulnerability Monitor exploitation of edge devices like Citrix NetScaler in real time 👉 http://console.defusedcyber.com/signup

🚨 Acaba de confirmarse: Citrix NetScaler ADC / Gateway está siendo atacado activamente debido a la vulnerabilidad CVE-2025-5777, apodada CitrixBleed 2. La vulnerabilidad permite a un atacante recolectar tokens de sesión activos desde fragmentos de memoria, lo que puede llevar a la toma de control de una sesión ya autenticada sin necesidad de contraseña ni MFA interactivo. El impacto técnico es grave, ya que un atacante puede reutilizar los tokens de sesión para crear acceso persistente y desplegar payloads posteriores, como el ransomware. Se han reportado campañas donde el acceso inicial llevó a la implantación de ransomware tras crear una cuenta admin. Hay un parche disponible, pero es crucial que los administradores de sistemas verifiquen si están expuestos y tomen medidas para parchear y rotar credenciales lo antes posible. ¿Estás en riesgo? Revisa esto: verifica si tu versión de Citrix NetScaler ADC / Gateway está afectada y aplica el parche de seguridad correspondiente. #Ciberseguridad #Ransomware #SeguridadDigital #PYMEsMX https://thehackernews.com/2026/07/weekly-recap-sharefile-threat-citrix.html

Linux Kernel — net/skbuff: shared-frag marker not propagated through frag-transfer helpers (DirtyClone) CVE: CVE-2026-43503 PT ID: PT-2026-42878 Vendor: Linux Product: Linux Kernel (net/skbuff, XFRM/IPsec) CVSS: 8.8 Credits: JFrog Security Research Description: A local privilege escalation issue exists in the Linux networking stack due to the improper propagation of the SKBFL SHARED FRAG flag during fragment transfers. Several helpers and functions, including pskb copy fclone(), skb shift(), skb gro receive(), skb gro receive list(), tcp clone payload(), skb segment(), and skb try coalesce(), fail to carry over this marker when moving fragment descriptors. This creates a mismatch where a socket buffer (skb) may reference externally-owned or page-cache-backed pages while reporting that it does not have shared fragments via skb has shared frag(). This flaw can be exploited by in-place writers, such as ESP input (esp4.c, esp6.c), which rely on skb has shared frag() to determine if data must be processed through skb cow data(). An unprivileged user can leverage this to write into the page cache of a root-owned read-only file. Real-world exploitation, dubbed DirtyClone, allows an application to escalate privileges to administrator/root levels. References: • [https://dbugs.ptsecurity.com/vulnerability/CVE-2026-43503 ](https://dbugs.ptsecurity.com/vulnerability/CVE-2025-5777)• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=48f6a5356a33dd78e7144ae1faef95ffc990aae0 -> (https://dbugs.ptsecurity.com/vulnerability/CVE-2025-5777)[ ](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420)• [https://research.jfrog.com/post/dissecting-and-exploiting-linux-lpe-variant-dirtyclone-cve-2026-43503/ ](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420) PoC/Exploit: https://github.com/rafaeldtinoco/security #dbugs_vuln

🚨 Top 25 CVE Exploitation Attempts - Team Cymru - S2 (Ranked by unique source IPs over 14 days) 1. CVE-2025-0282 · Ivanti Connect Secure 2. CVE-2025-49706 · SharePoint 3. CVE-2020-3452 · Cisco ASA 4. CVE-2025-61884 · Oracle EBS 5. CVE-2024-32113 · Apache OFBiz 6. CVE-2025-53770 · SharePoint 7. CVE-2025-24893 · XWiki 8. CVE-2025-61882 · Oracle EBS 9. CVE-2025-5777 · Citrix NetScaler 10. CVE-2025-34028 · Commvault 11. CVE-2024-57727 · SimpleHelp 12. CVE-2025-20362 · Cisco ASA/FTD 13. CVE-2024-1212 · Kemp LoadMaster 14. CVE-2024-38856 · Apache OFBiz 15. CVE-2022-40684 · Fortinet 16. CVE-2024-9465 · Palo Alto Expedition 17. CVE-2025-11371 · Gladinet CentreStack 18. CVE-2025-58360 · GeoServer 19. CVE-2025-57819 · FreePBX 20. CVE-2025-31324 · SAP NetWeaver 21. CVE-2024-7593 · Ivanti vTM 22. CVE-2025-31125 · Vite Dev Server 23. CVE-2025-64446 · FortiWeb 24. CVE-2024-12987 · DrayTek Vigor 25. CVE-2018-7600 · Drupal

IR/CERT Morning Brief Today’s brief centered on exploitable enterprise exposure and follow-on access risk: Citrix NetScaler CVE-2025-5777 / CVE-2025-5349, SAP NetWeaver abuse tied to the “10KBLAZE” cluster, SonicWall SMA credential exposure concerns, and ClickFix-style malware delivery. Bottom line: patch exposed edge systems fast, review auth/session risk, and treat criminal chatter as early warning until independently verified. #cybersecurity #threatintel #IR #CERT

CVE-2025-5777 "CitrixBleed 2" is being actively exploited by an IAB to steal live NetScaler sessions, escalate to SYSTEM via a registry symlink primitive, and deploy DragonForce ransomware, all in under an hour across multiple unrelated orgs. - CVE-2025-5777 is a pre-auth memory overread in NetScaler ADC/Gateway. A burst of malformed POST requests to /p/u/doAuthentication.do with an empty login field leaks ~127 bytes of heap per request, including live session tokens. MFA is irrelevant once a token is stolen and replayed. Forensic proof lives in ns.log: 5,000+ AAA LOGIN_FAILED events with binary garbage in the User field is leaked heap, not a spray. A session active from an attacker IP with zero successful logins is the smoking gun. - Printer mappings are a gift. Citrix auto-creates client printer entries in the Windows Application log, embedding the attacker's workstation name. WIN-4E0AP4JTJR9 and WIN-VI960VQI4I6 appeared case after case. Pivot between Microsoft-Windows-TerminalServices-LocalSessionManager/Operational (source IP plus session ID) and MetaFrameEvents (session ID to client name) to fingerprint the operator's machine. - Privilege escalation uses a REG_LINK registry symlink planted under the RdpBus device class GUID, redirected into GPO-List\test. gpupdate forces a SYSTEM-context write through the link; sc start AppMgmt detonates it. #DFIR_Radar

Ransomware isn't a malware problem, it's a credential handover nobody caught. CVE-2025-5777 handed Anubis session tokens; RMM tools handled the rest. QuanChain rotates 20 security levels in <200ms, before lateral movement completes. Is rotation speed now the real perimeter? https://t.co/nbRq38NHev

In our latest investigation, Arctic Wolf provides new insight into initial access techniques in #Anubis ransomware cases, including exploitation of #CitrixBleed 2 (CVE-2025-5777). Learn more: https://arcticwolf.com/resources/blog/citrixbleed-2-to-cloudflared-the-tools-and-techniques-behind-anubis-ransomware-attacks/ #EndCyberRisk https://t.co/SdT3ysSVbW

Top 5 Trending CVEs: 1 - CVE-2022-40769 2 - CVE-2025-5777 3 - CVE-2025-8088 4 - CVE-2023-41064 5 - CVE-2026-21643 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard

🚨 زيادة اختراقات وحملات إلكترونية عالمية ملخص الأسبوع: تقرير يكشف عن تصاعد الاختراقات الأمنية والإجراءات التنظيمية وتطورات الجريمة الإلكترونية حول العالم، مع التركيز على ثغرات CVE-2025-20337 و CVE-2025-5777. 💡 إجراءات الحماية: - تطبيق أحدث الـ Patches لهذه الثغرات فور توفرها. - مراجعة وتحديث سياسات أمن المعلومات بشكل دوري. - رفع مستوى الوعي لدى الموظفين بمخاطر الهجمات الإلكترونية. 🔗 https://thecyberexpress.com/weekly-roundup-cyber-express-feb-2026/ #الأمن_السيبراني #التهديدات_السيبرانية #CVE

Anubis ransomware exploits Citrix Bleed 2 (CVE-2025-5777) for initial access. Affiliates abuse RMM tools, VPN credentials, and cloud transfer tools for data theft. For More: https://www.redsecuretech.co.uk/blog/post/anubis-ransomware-exploits-citrix-bleed-2-for-initial-access/1294 #AnubisRansomware #CitrixBleed2 #CVE #Ransomware #RaaS #BYOVD #RMMAbuse #VECT https://t.co/fe5qLIarlg

the company disclosed a significant scale breach. data we'll see leaked next month. lesson: every internet-facing service should age out quarterly. #Citrix #ransomware #OpenSource #CVE-2025-5777 https://valtikstudios.com

Top 5 Trending CVEs: 1 - CVE-2026-21992 2 - CVE-2025-5777 3 - CVE-2026-3909 4 - CVE-2025-32975 5 - CVE-2008-0166 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard

CitrixBleed 2 の悪用と NetScaler 侵害：DragonForce ランサムウェア展開を Huntress が検出 https://iototsecnews.jp/2026/07/10/hackers-exploit-citrixbleed-2-to-hijack-mfa-protected-sessions-and-deploy-dragonforce-ransomware/ CitrixBleed 2 (CVE-2025-5777) と呼ばれる脆弱性が原因で発生した、サイバー攻撃について解説する記事です。この問題の根本的な原因は、NetScaler のログイン・エンドポイントに対して不正な形式の POST リクエストが送信されることで、認証前のメモリ・オーバーリードが引き起こされる点にあります。攻撃者が空のログイン・パラメータを大量に送信すると、機器のメモリ内にあるアクティブなセッション情報などのデータが漏洩してしまいます。その結果として、正規のユーザーが認証を済ませた有効なセッションが盗まれ、MFA (多要素認証) がバイパスされ、不正アクセスを許すことになります。ご利用のチームは、ご注意ください。 #Citrix #CitrixBleed2 #DragonForce #Exploit #NetScaler #Ransomware

📌 CitrixBleed 2 (CVE-2025-5777) 7Steps to Dragonforce Ransomware | Huntress

CVE-2025-5777, CVSS 9.3. Nicknamed CitrixBleed 2. An out-of-bounds read in Citrix NetScaler ADC and Gateway. Send a POST with malformed login parameters to /p/u/doAuthentication.do and the appliance returns chunks of its own memory.

Hackers exploited the CitrixBleed 2 vulnerability (CVE-2025-5777) in Citrix NetScaler appliances nearly two weeks before a public PoC was released. This underscores the need for proactive threat intelligence and rapid patch management to mitigate such risks effectively. #CitrixBleed2 #CVE20255777 #CyberSecurity #NetScaler #ThreatIntelligence #PatchManagement https://thedailytechfeed.com/citrixbleed-2-exploited-before-public-disclosure/

2/3 After entry via CVE-2025-5777, Anubis affiliates steal credentials and move laterally using multiple RMM tools. The tactic of blending with legitimate admin software makes detection much harder for security teams. #ransomware #lateralmovement #infosec

1/3 Anubis ransomware affiliates are exploiting Citrix Bleed 2 (CVE-2025-5777) to gain initial access. They use ScreenConnect, Zoho Assist, and MeshAgent to blend in as normal IT activity. Anubis is a rebrand of Sphinx RaaS, active since late 2024. #ransomware #CVE #cybersecurity

Anubis ransomware affiliates are exploiting CitrixBleed 2 (CVE-2025-5777) and abusing legitimate RMM tools plus Cloudflared tunnels to blend into target environments across 2026 intrusions. Key findings: - Initial access comes via two paths: stolen VPN credentials and exploitation of CVE-2025-5777 (CitrixBleed 2), making perimeter device telemetry a priority artifact to pull early in any Anubis investigation. - Post-access, affiliates rely on legitimate RMM tools for persistence and lateral movement, a classic living-off-the-land pattern (T1219) that lets malicious sessions hide inside expected remote management traffic. - Cloudflared tunnels are used to establish covert C2 channels, routing traffic through Cloudflare's infrastructure to avoid egress-based detection and bypass firewall rules that would flag unknown C2 domains. - Despite affiliate variation in TTPs, the consistent thread is abuse of trusted tooling: RMM software and tunnel utilities leave process creation, network connection, and service installation artifacts that endpoint telemetry should capture. Takeaway: Pull Citrix ADC session logs for CVE-2025-5777 exploitation evidence, then hunt process trees for Cloudflared spawning from unexpected parents. Flag any RMM binary not in your approved software inventory making outbound connections. Perimeter and EDR telemetry correlation is the key to breaking this chain early. #DFIR_Radar