Reported by 6 outlets
When Patching Isn't Enough: What the Fairlife Ransomware Attack Says About Network Edge Risk
Why this score
- Breadth
- 2.00 / 2.0 · 6 sources
- Authority
- 1.50 / 2.0 · best outlet weight
- Severity
- 4.70 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
The Fairlife incident began with CVE-2025-5777, the NetScaler memory-disclosure flaw dubbed CitrixBleed 2, which leaks uninitialized memory from appliances configured as a Gateway or AAA virtual server and yields session tokens that work past MFA. Citrix rated it 9.3 CVSS and disclosed it on June 17, 2025 with fixed builds 14.1-43.56, 13.1-58.32, 13.1-FIPS 13.1-37.235 and 12.1-FIPS 12.1-55.328. The Anubis group claims it used the bug for initial access, encrypted Fairlife's Nutanix systems and stole about 1 TB of data; Coca-Cola confirmed data was taken, suspended production across Fairlife's US facilities, and restored the majority of output 11 days after its initial disclosure.
The date arithmetic is the story. CISA put the bug in the KEV catalog on July 10, 2025 with a one-day federal patch deadline, GreyNoise honeypot telemetry showed exploitation attempts from June 23, 2025, and two working public exploits were published by July 7, 2025. A Coca-Cola-owned dairy producer was still breached by a flaw whose public fix predates the compromise by more than a year, so the real exposure window for edge devices runs from exploit availability to the last straggler patching, not from vendor disclosure to first patch. Any organization that ran a vulnerable NetScaler Gateway during the mid-2025 mass scanning and caught up later must assume session tokens and credentials were harvested and can sit dormant until ransomware day; Fairlife is what that assumption looks like when it matures into an encrypted Nutanix cluster and a 1 TB extortion claim.
Inventory every NetScaler ADC and Gateway build and upgrade anything below 14.1-43.56, 13.1-58.32, 13.1-FIPS/NDcPP 13.1-37.235 or 12.1-FIPS 12.1-55.328, then terminate all active and persistent ICA and PCoIP sessions and force reauthentication, since tokens issued before the patch stay valid after it. Hunt on the appliance: POSTs to /p/u/doAuthentication.do carrying a bare login parameter, authentication responses whose InitialValue element contains non-printable bytes, and ns.log entries with non-printable characters. Audit NetScaler Gateway sessions for one account used from multiple client IPs at once, and diff show ns runningConfig -withDefaults against known-good backups for added admin accounts, the persistence pattern researchers documented for this bug class.
Two developments would change this assessment. Confirmation from Fairlife, Coca-Cola or incident responders that initial access actually traces to CVE-2025-5777, rather than resting on the group's assertion, would validate the patch-lag narrative; publication of the claimed 1 TB on Anubis's leak site would turn an unverified extortion claim into confirmed exposure and show what the stolen Nutanix data contained.
Timeline
-
original reporting
When Patching Isn't Enough: What the Fairlife Ransomware Attack Says About Network Edge Risk
malware.news · 61d ago · August 13th, 2026
A recent ransomware incident at Coca-cola owned dairy company Fairlife provides a potent example of network edge devices being targeted for exploitation, and of the scale of outcomes attackers can achieve by exploiting them. According to reporting from MSN and others, the ransomware attack caused Fairlife to temporarily suspend production across its U.S. facilities after an unauthorized third party gained access to systems that included production-related infrastructure. Eleven days after the initial disclosure, Coca-Cola said the majority of production had resumed. The Anubis ransomware group claimed responsibility. The group said it encrypted Fairlife’s Nutanix systems and stole approximately 1 TB of data. Coca-Cola subsequently confirmed that data had been taken, although it has not publicly validated all of Anubis’s claims about the attack. According to published reporting , Anubis exploited CitrixBleed 2 (CVE-2025-5777) to gain initial access to Fairlife’s environment before encrypting its Nutanix infrastructure. The resulting ransomware incident suspended U.S. production, with the majority of production restored 11 days after Coca-Cola’s initial disclosure. Regardless of what further details emer
-
update from support.citrix.com
Citrix security bulletin CTX693420: NetScaler ADC and Gateway fix for CVE-2025-5777
support.citrix.com · 484d ago · June 17th, 2025
Citrix disclosed CVE-2025-5777 and shipped fixed builds on June 17, 2025, for insufficient input validation leading to a memory overread in NetScaler ADC and Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Fixed builds include 14.1-43.56, 13.1-58.32, 13.1-FIPS/NDcPP 13.1-37.235 and 12.1-FIPS 12.1-55.328, and the advisory recommends terminating existing ICA and PCoIP sessions. Publication date corroborated by the NVD record (published Jun 17, 2025) and contemporaneous reporting; the Citrix page itself blocks automated access.
-
update from labs.watchtowr.com
watchTowr Labs: How Much More Must We Bleed? Citrix NetScaler Memory Disclosure (CitrixBleed 2, CVE-2025-5777)
labs.watchtowr.com · 467d ago · July 4th, 2025
watchTowr researchers published patch-diff analysis attributing the leak to use of an uninitialized variable (CWE-457) in the nsppe binary: sending POST /p/u/doAuthentication.do with a login parameter but no value returns uninitialized stack memory inside the InitialValue element of the authentication response. The post provides a benign detection request plus vulnerable and patched response examples, and notes that a significant portion of the NetScaler user base had still not patched while in-the-wild exploitation was ongoing.
-
update from horizon3.ai
Horizon3.ai: CVE-2025-5777 CitrixBleed 2 Write-Up... Maybe?
horizon3.ai · 464d ago · July 7th, 2025
Horizon3's Jimi Sebree demonstrated a working exploit leaking up to 127 bytes per request, recovering legitimate user session tokens, an nsroot token for the entire appliance, and plaintext credentials from login request bodies. The write-up gives defenders hunting guidance: ns.log entries containing non-printable characters, a single account with concurrent sessions from multiple client IP addresses, session review via show sessions, and diffing show ns runningConfig -withDefaults output against known-good backups to spot added backdoor accounts.
-
update from cisa.gov
CISA adds Citrix NetScaler CVE-2025-5777 to the Known Exploited Vulnerabilities Catalog
cisa.gov · 461d ago · July 10th, 2025
CISA added 'Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability' (CVE-2025-5777) to the KEV catalog on July 10, 2025, citing evidence of active exploitation, with a federal remediation due date of July 11, 2025.
-
update from theregister.com
The Register: Now everybody but Citrix agrees that CitrixBleed 2 is under exploit
theregister.com · 460d ago · July 10th, 2025
Jessica Lyons reported CISA's KEV listing of CVE-2025-5777, noting Citrix had said on June 26, 2025 there was no evidence of exploitation and only updated its blog on July 11 to urge immediate patching while stating there are no available mitigations. The article cites Kevin Beaumont's reporting based on GreyNoise honeypot telemetry showing exploitation attempts dating back to June 23, 2025, and Akamai's observation of a drastic increase in scanner traffic after exploit details went public.