New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure

Hackers are targeting NetScaler appliances using public PoC code to retrieve arbitrary memory content in the HTTP response. The post New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure appeared first on SecurityWeek .

The article reports that a newly disclosed CitrixBleed-style vulnerability in Citrix NetScaler/ADC devices is being exploited almost immediately using publicly available proof-of-concept code to read arbitrary appliance memory via crafted HTTP requests, exposing session tokens and other sensitive data from affected systems.[4][6][8] This continues the pattern seen with CVE-2023-4966 and CVE-2025-5777, where memory leak bugs in widely deployed infrastructure devices are rapidly weaponized after disclosure and added to CISA’s Known Exploited Vulnerabilities catalog.[2][4][7] From a CyberSE.AI perspective, this highlights a critical AI supply chain risk: enterprise AI agents and models that depend on NetScaler-backed VPNs, SSO gateways, or API endpoints can have their sessions and credentials compromised at the network edge, indirectly exposing model access tokens, data pipelines, and management consoles. Organizations should treat Citrix/NetScaler infrastructure as part of their AI supply chain SBOM, enforce rapid patching and forced session revocation, and incorporate continuous red teaming to validate that AI-related services are not reachable via compromised Citrix sessions.