FortiGuard Outbreak Alert: Citrix Bleed 2
| Description | FortiGuard Labs have observed a significant increase in the explanation attempts targeting the 'Citrix Bleed 2' vulnerability (CVE-2025-5777 & CVE-2025-6543) since July 28, 2025.
These vulnerabilities affect Citrix NetScaler ADC and Citrix NetScaler Gateway.
CVE-2025-5777 is an out of bound vulnerability which an unauthenticated attacker can send specially crafted request to leak sensitive memory content on the vulnerable appliance.
CVE-2025-5349 is an improper access control vulnerability which an unauthenticated attacker can access management functionality.
CVE-2025-6543 is a critical memory overflow vulnerability which an unauthenticated attacker can trigger and lead to denial of service.
The following versions of NetScaler products are patched against CVE-2025-6543:
The following versions of NetScaler products are patched against CVE-2025-5777 and CVE-2025-5349:
| ||||||
| CVE ID    | CVE-2025-5777 (https://nvd.nist.gov/vuln/detail/CVE-2025-5777) CVE-2025-5349 (https://nvd.nist.gov/vuln/detail/CVE-2025-5349) CVE-2025-6543 (https://nvd.nist.gov/vuln/detail/CVE-2025-6543) | ||||||
| NDR Cloud Detection Rule | FortiNDR Cloud v25.3a+
| ||||||
| Playbook | N/A | ||||||
| Threat Hunting | FortiNDR Cloud users can use the following IOCs from Fortinet to hunt for "Citrix Bleed 2" related activities. IOC source: https://www.fortiguard.com/outbreak-ioc?tag=Citrix%20Bleed%202 All IOCs relating to "Citrix Bleed 2" have been added to Threat Intelligence Intel. | ||||||
| Suricata Coverage | Customers can create custom investigation/detections using the Suricata signatures below: 2063315 -> ET WEB_SPECIFIC_APPS Citrix Netscaler ADC & Gateway Memory Leak CitrixBleed2 (CVE-2025-5777) | ||||||
| Other Fortinet Products | For more details regarding mitigating the vulnerability by utilizing Fortinet products, please refer to: https://www.fortiguard.com/outbreak-alert/citrix-bleed-2 |
