Citrix Bleed 2

FortiGuard Labs observed a sharp increase in exploitation of Citrix NetScaler vulnerabilities—most notably CVE-2025-5777 ('Citrix Bleed 2')—with telemetry showing over 6,000 IPS detections globally since July 28, 2025; related critical flaws CVE-2025-6543 and CVE-2025-5349 are also noted. The vulnerabilities can disclose server memory (potentially exposing credentials and session tokens) or cause control-flow issues and DoS; organizations using NetScaler ADC/Gateway are urged to apply Citrix patches immediately and monitor for suspicious activity.