Thousands of Citrix NetScaler boxes still sitting ducks despite patches

Citrix released patches for three critical NetScaler flaws, including CVE-2025-7775 (CVSS 9.2, called CitrixBleed 3), which is being actively exploited in the wild as a pre-auth RCE to deploy web shells; despite fixes, Shadowserver observed ~13,000 vulnerable appliances still exposed, prompting CISA to add the CVE to its KEV list and warnings from national cyber agencies about likely mass exploitation.