What’s Vulnerable › Vulnerabilities
CVE-2025-5777: NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2025-07-10
- EPSS: 100.0% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-06-17 · updated 2026-10-08
- Weakness: CWE-125
Description
Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
Summary
CVE-2025-5777 is an out-of-bounds read in Citrix NetScaler ADC and Gateway caused by insufficient input validation when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. This can lead to memory overread, potentially exposing sensitive information. The flaw is actively exploited (listed in CISA KEV, SSVC active, EPSS 100%) and a public exploit exists. Affected versions are fixed in NetScaler ADC 12.1-55.328, 13.1-37.235, 13.1-58.32, 14.1-43.56 and NetScaler Gateway 13.1-58.32, 14.1-43.56; apply these updates or follow vendor mitigations immediately.
CVE-2025-5777 هو ثغرة قراءة خارج الحدود في Citrix NetScaler ADC وGateway ناتجة عن تحقق غير كافٍ من المدخلات عند تكوينه كـ Gateway (خادم VPN افتراضي، ICA Proxy، CVPN، RDP Proxy) أو خادم AAA افتراضي. قد يؤدي ذلك إلى قراءة زائدة للذاكرة مما قد يكشف معلومات حساسة. الثغرة مستغلة بنشاط (مدرجة في CISA KEV، SSVC نشط، EPSS 100%) ويوجد استغلال عام. الإصدارات المتأثرة تم إصلاحها في NetScaler ADC 12.1-55.328، 13.1-37.235، 13.1-58.32، 14.1-43.56 وNetScaler Gateway 13.1-58.32، 14.1-43.56؛ طبق هذه التحديثات أو اتبع إرشادات التخفيف من البائع فورًا.
Affected products
- Citrix NetScaler ADC: from 13.1 before 13.1-58.32; from 14.1 before 14.1-43.56 — fixed in 13.1-58.32, 14.1-43.56
- Citrix Netscaler Application Delivery Controller Fips: from 12.1 before 12.1-55.328; from 13.1 before 13.1-37.235 — fixed in 12.1-55.328, 13.1-37.235
- Citrix Netscaler Application Delivery Controller Ndcpp: from 13.1 before 13.1-37.235 — fixed in 13.1-37.235
- Citrix NetScaler Gateway: from 13.1 before 13.1-58.32; from 14.1 before 14.1-43.56 — fixed in 13.1-58.32, 14.1-43.56
- NetScaler ADC: from 14.1 before 43.56; from 13.1 before 58.32 — fixed in 43.56, 58.32
- NetScaler Gateway: from 14.1 before 43.56; from 13.1 before 58.32 — fixed in 43.56, 58.32
How to fix
Upgrade to a fixed version: Citrix NetScaler ADC 13.1-58.32, 14.1-43.56; Citrix Netscaler Application Delivery Controller Fips 12.1-55.328, 13.1-37.235; Citrix Netscaler Application Delivery Controller Ndcpp 13.1-37.235; Citrix NetScaler Gateway 13.1-58.32, 14.1-43.56; NetScaler ADC 43.56, 58.32; NetScaler Gateway 43.56, 58.32. Check the vendor advisory for mitigations.
In the news
References
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420
- https://citrixbleed.com
- https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/
- https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/
- https://www.bleepingcomputer.com/news/security/cisa-tags-citrix-bleed-2-as-exploited-gives-agencies-a-day-to-patch/
- https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/
- https://www.theregister.com/2025/07/10/cisa_citrixbleed_kev/
- https://doublepulsar.com/citrixbleed-2-exploitation-started-mid-june-how-to-spot-it-f3106392aa71
- https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-5777
Get alerted when CVE-2025-5777 or the next vulnerability affects your stack