Attackers are still hammering a critical flaw in Citrix NetScaler appliances known as CitrixBleed 2, with honeypot sensors recording more than 303,000 exploitation attempts in the past 30 days. The flaw, tracked as CVE-2025-5777, carries a CVSS score of 9.3 and is listed in the US CISA Known Exploited Vulnerabilities catalogue.

Threat monitoring firm OffSeq said its global honeypot fleet recorded 303,344 exploitation attempts against the flaw from 21 distinct source IP addresses in the 30 days to Tuesday, 10 November 2026, with the most recent attempt seen at 03:41 UTC that morning. The sensors first observed the activity on 11 October. OffSeq also tracked three internet-exposed hosts running the vulnerable software in the same period.

A pre-authentication memory leak

CitrixBleed 2 is a memory-overread vulnerability in Citrix NetScaler ADC and NetScaler Gateway appliances. It allows attackers to send malformed pre-authentication login requests that leak memory containing valid session tokens, letting them hijack sessions and bypass multi-factor authentication.

Once inside, attackers escalate privileges using a registry-symlink technique targeting the AppMgmt service, create rogue administrator accounts, and keep access through legitimate remote access tools. The attack chain is highly standardised, which researchers say points to a single initial access broker selling or handing off access.

From stolen sessions to ransomware

Security company Huntress investigated about half a dozen intrusions in the first half of 2026 that followed the same pattern across unrelated organisations in different industries. In the most advanced case, the operator deployed DragonForce ransomware, encrypting one host before responders contained it. Huntress assesses with high confidence that an initial access broker is weaponising the flaw, and Sophos has tracked the same cluster as STAC3725.

Public exploit code for the flaw is available, and the vulnerability has been actively exploited in multiple unrelated organisations. Citrix has issued fixes and guidance for the flaw, but any appliance that has not been patched remains exposed to a well-understood attack that can turn a single stolen session into a full ransomware incident.

The flaw is a sequel to the original CitrixBleed, tracked as CVE-2023-4966, which was also a pre-authentication memory-overread in NetScaler ADC and Gateway appliances configured as a Gateway or AAA virtual server. That earlier flaw was widely exploited in 2023. CitrixBleed 2 follows the same playbook: leak memory, steal a live session, and walk in through the front door with a legitimate user's credentials.

What admins should do

Organisations running NetScaler ADC or Gateway appliances configured as a Gateway or AAA virtual server should check they have applied the vendor fix, terminate any sessions that may have been exposed, and review logs for signs of session hijacking. With more than 300,000 attempts in a single month, the flaw is not a historical curiosity: it is still being probed, at scale, right now.