'CitrixBleed 2' Shows Signs of Active Exploitation

A critical out-of-bounds read vulnerability (CVE-2025-5777, "CitrixBleed 2") in Citrix NetScaler ADC and Gateway can expose session tokens and allow authentication bypass and prolonged access. ReliaQuest reports indicators consistent with active exploitation—hijacked Citrix sessions, session reuse across IPs, AD reconnaissance activity, and presence of ADExplorer64.exe—and Citrix has published patched releases that organizations should deploy immediately.