'CitrixBleed 2' Wreaks Havoc as Zero-Day Bug

CitrixBleed 2 and Cisco’s high-severity flaw have underlined growing adversary interest in identity and access management, with Citrix NetScaler ADC and Gateway affected by CVE-2025-5777 and Cisco ISE by CVE-2025-20337 (CVSS 10). Citrix disclosed CVE-2025-5777 in June, and Amazon’s threat intelligence team later corroborated Beaumont’s findings, noting zero-day exploit activity in the wild before patching.

The patch for CitrixBleed 2 was issued on 17 June 2025, meaning some systems patched promptly after the disclosure could already have been compromised, according to Amazon. Amazon’s CISO CJ Moses described the Cisco ISE exploitation as pre-patch and pre-CVE assignment, highlighting a patch-gap exploitation technique used by sophisticated threat actors.

The same attackers were observed leveraging the Cisco ISE vulnerability at the same time as the Citrix flaw, suggesting a highly skilled actor with deep technical insight into both Citrix and Cisco codebases, according to the report.