Cisco ISE, CitrixBleed 2 Vulnerabilities Exploited as Zero-Days: Amazon

According to Amazon, a threat actor exploited two critical Citrix and Cisco vulnerabilities as zero-days weeks before patches were released, with detection of in-the-wild activity noted ahead of public disclosure. The Citrix flaw, CVE-2025-5777 (CVSS 9.3), affects NetScaler ADC and NetScaler Gateway and was patched on 17 June, later dubbed CitrixBleed 2 by security researcher Kevin Beaumont.

Amazon’s report also details zero-day exploitation of CVE-2025-20337 in Cisco Identity Service Engine (ISE), disclosed on 16 July, which enables unauthenticated attackers to execute arbitrary code with root privileges.

The exploitation involved a backdoor web shell targeting ISE environments, operating in-memory and using Java reflection to inject into running threads, and it monitored HTTP requests across the Tomcat server while evading detection via DES encryption with non-standard Base64 encoding and specific HTTP headers. The company notes the attacks appeared to be orchestrated by a highly resourced actor with access to unpublished zero-days, though SecurityWeek could not share attribution.

The story, published on 13 November 2025, underscores how weaponised flaws in enterprise infrastructure can threaten large organisations ahead of patches.