CitrixBleed 2 (CVE-2025-5777): NetScaler ADC / Gateway memory overread leaks session tokens. Which builds fix it, and why do I have to kill sessions after patching?

What it is: CVE-2025-5777 (CVSS 9.3), nicknamed CitrixBleed 2, is an out-of-bounds read in NetScaler ADC and NetScaler Gateway. An unauthenticated attacker can make the appliance return pieces of its memory, which can include valid session tokens, letting them take over logged-in sessions and skip MFA. It was patched in June 2025, added to CISA's Known Exploited Vulnerabilities catalog in July 2025, and was exploited at large scale, yet internet scans keep finding unpatched and end-of-life appliances. Am I affected: - Only appliances configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. - Builds before: 14.1-43.56, 13.1-58.32, 13.1-FIPS / 13.1-NDcPP 13.1-37.235, 12.1-FIPS 12.1-55.328. Check with 'show version' on the CLI or in the GUI. - Versions 12.1 (non-FIPS) and 13.0 are end of life and will never be fixed: upgrade them to a supported line. Fix: 1. Upgrade to 14.1-43.56 or later, 13.1-58.32 or later, or the fixed FIPS/NDcPP builds above (or anything newer on a supported line). 2. After all appliances in an HA pair or cluster are upgraded, terminate every active session, because tokens stolen before the patch stay valid otherwise. Citrix's bulletin lists the commands: kill ICA and PCoIP connections, and (per Citrix's follow-up guidance) AAA sessions, RDP connections and load-balancing persistent sessions, each with the -all option. After: - Look for signs of earlier abuse: sessions reused from unexpected IP addresses or countries, the same session shared by different client IPs, unexpected admin or VPN logins, and new local accounts or changed configuration on the appliance. - If you find any, reset passwords for affected users, review what those sessions reached on the internal network, and treat the appliance as possibly compromised. - The same June 2025 update also fixes CVE-2025-5349 (management interface access control). Sources: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420 https://www.securityweek.com/exploits-technical-details-released-for-citrixbleed2-vulnerability/ https://horizon3.ai/attack-research/vulnerabilities/cve-2025-5777/