Search: CVE-2026-4368

Race Condition in NetScaler ADC and NetScaler Gateway when appliance is configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server leading to User Session Mixup

CVE-2025-5777, known as CitrixBleed 2, is a memory-overread vulnerability in Citrix NetScaler ADC and Gateway appliances. It allows attackers to send malformed pre-authentication login requests that leak memory containing valid session tokens, enabling session hijacking and bypass of multi-factor authentication. Exploitation leads to privilege escalation via a registry-symlink technique targeting the AppMgmt service, creation of rogue administrator accounts, and persistence through legitimate remote access tools. The vulnerability has been actively exploited in multiple unrelated organizations, culminating in deployment of DragonForce ransomware in the most severe cases. The attack chain is highly standardized, indicating a single initial access broker. The vulnerability is listed in the CISA KEV catalog and public exploit code is available. Patch status is not confirmed in the provided data.