CISA orders agencies to immediately patch Citrix Bleed 2, saying bug poses ‘unacceptable risk’

The Cybersecurity and Infrastructure Security Agency (CISA) ordered federal civilian agencies to patch CVE-2025-5777 ("Citrix Bleed 2") within 24 hours after Citrix disclosed a critical (9.2) memory-disclosure vulnerability in NetScaler ADC/Gateway appliances that researchers and responders report is being actively exploited; the flaw can expose session tokens and enable MFA bypass, has been linked to ransomware-related activity, and prompted advisories from vendors and national bodies including the U.K. NHS.