CVE-2025-5777criticalunder attackransomwareCWE-125

CVE-2025-5777: critical vulnerability in NetScaler ADC

NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread

Published 17 Jun 2025 · Updated 07 Oct 2026

Follow this CVE + Monitor NetScaler Gateway + Monitor NetScaler ADC

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.3epss 100%

from disclosure to weaponsame day

Published on NVDJun 17

1st PoCMay 27

CISA KEV+23d

Action required by CISAfederal deadline: 2025-07-11

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

NetScaler ADC and NetScaler Gateway have a flaw where they don't properly check user input, allowing attackers to read data from memory they shouldn't access. This is dangerous because it can expose sensitive information like passwords or encryption keys.

Technical detail

Insufficient input validation in NetScaler Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) and AAA virtual servers enables out-of-bounds memory read (CWE-125, CWE-457). An attacker can craft malicious input to trigger memory overread, potentially disclosing sensitive data without authentication or special privileges, depending on the specific configuration.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Affected products

NetScaler · ADC NetScaler · Gateway

public PoCs found — 53

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Related CVEs — NetScaler ADC

In the same product, most dangerous first.

CVE-2026-3055CRITICALInsufficient input validation leading to memory overreadEPSS 91.5%KEV CVE-2026-19490CRITICALNetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490EPSS 33.3%KEV CVE-2025-7775CRITICALMemory overflow vulnerability leading to Remote Code Execution and/or Denial of ServiceEPSS 20.7%KEV CVE-2026-88779HIGHMemory overflow vulnerability leading to Denial of ServiceEPSS 11.4%KEV CVE-2025-6543CRITICALMemory overflow vulnerability leading to unintended control flow and Denial of ServiceEPSS 10.4%KEV CVE-2026-8452HIGHMemory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of ServiceEPSS 1.0%KEV

References

https://citrixbleed.com https://doublepulsar.com/citrixbleed-2-exploitation-started-mid-june-how-to-spot-it-f3106392aa71 https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420 https://www.bleepingcomputer.com/news/security/cisa-tags-citrix-bleed-2-as-exploited-gives-agencies-a-day-to-patch/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-5777 https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/https://www.theregister.com/2025/07/10/cisa_citrixbleed_kev/