Citrix Netscaler CVE-2025-5777 Exploit Attempt

Tim Peck@timpeck

•updated Oct 22, 2025•5•0•174

Detects potential exploitation attempts of Citrix NetScaler vulnerability CVE-2025-5777 (CitrixBleed 2). This involves malformed or unusually large HTTP POST requests to the /p/u/doAuthentication.do endpoint, a technique used by groups like Earth Estries.