Over 1,200 Citrix servers unpatched against critical auth bypass flaw

A critical Citrix NetScaler vulnerability (CVE-2025-5777, “Citrix Bleed 2”) allows unauthenticated attackers to read out-of-bounds memory, steal session tokens, hijack user sessions and bypass MFA; Shadowserver reports thousands of exposed unpatched appliances while ReliaQuest assesses with medium confidence that the flaw is being actively exploited with observed post-exploitation indicators (session reuse, LDAP queries). Citrix urges immediate patching and session termination; organizations should apply patches, review access controls, and monitor NetScaler gateways for suspicious sessions and AD reconnaissance.