<ul data-eligibleForWebStory="false"><li>A critical vulnerability in Citrix's network management devices has been actively exploited for more than a month, despite the vendor's advisories stating otherwise.</li><li>The vulnerability, tracked as CVE-2025-5777, is similar to a previous flaw known as CitrixBleed, which led to the compromise of 20,000 Citrix devices two years ago.</li><li>Citrix disclosed the newer vulnerability and released a patch on June 17 but stated they were 'currently unaware of any evidence of exploitation', while researchers found evidence of active exploitation since at least June 23.</li><li>Security firms have criticized Citrix for withholding indicators that could help customers determine if their networks are under attack, stating that merely patching vulnerable devices is not enough and that customers should look for signs of compromise.</li></ul>

Critical CitrixBleed 2 vulnerability has been under active exploit for weeks

Discover more