Citrix NetScaler ADC and NetScaler Gateway Vulnerabilities

FortiGuard Labs reports a sharp rise in exploitation attempts against the 'Citrix Bleed 2' vulnerability since 28 July 2025 with over 6,000 IPS detections globally, concentrated in the US, Australia, Germany, and the UK and targeting high-value sectors (technology, banking, healthcare, education). The alert also summarizes Iran-linked operations using low-complexity but disruptive TTPs—phishing, DDoS, data exfiltration and destructive attacks—with initial access frequently achieved via known, unpatched vulnerabilities and exposed edge infrastructure.