Researchers at Watchtowr have released technical details on an exploit for the “CitrixBleed 2” (CVE-2025-5777) vulnerability released on 2025-06-17, leading to the development of a Proof of Concept (PoC) exploit.

A technical breakdown of the vulnerability shows that, in short, supplying the vulnerable authentication endpoint “/p/u/doAuthentication.do” with a modified “login” parameter triggers a memory leak. The resulting request contains the contents of an uninitialized local variable, which due to the behaviour of the compiled code means that contents of the application’s memory are copied and displayed in the body of the HTTP response.

This is important from a security perspective because the application’s memory can contain critical information, including cached login credentials, IP addresses and other sensitive data. Exploitation of this vulnerability can lead to disclosure of this information by remote, unauthenticated threat actors.

The information provided by Watchtowr has informed the development of a PoC exploit by security researcher Guilherme Nocera. The existence of a PoC means that widespread exploitation of vulnerable devices is now highly likely.

The new vulnerability has some relevant similarities to the original (CVE 2023 4966), which are shown below.

However, there are some key differences in the nature of the exploit, which also affect detection. The new exploit also allows for leaking of larger arbitrary memory chunks when compared to the previous one.

As stated above, there are no mitigations for unpatched devices, so patching to the latest version is highly recommended per our advisory on the vulnerability.

Please refer to our original advisory for guidance on updating any vulnerable devices.