CVE-2025-5777
Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability
Description
CVE-2025-5777 is a high-severity memory disclosure vulnerability in Citrix NetScaler ADC and NetScaler Gateway, widely referred to as "CitrixBleed 2." The flaw stems from out-of-bounds read and uninitialized memory access weaknesses in the VPN and AAA virtual server components, allowing an unauthenticated remote attacker to extract sensitive information from device memory, including session tokens and credentials. With a CVSS v3.1 score of 7.5 and confirmed active exploitation in the wild, CISA issued an emergency directive with a remediation deadline of July 11, 2025 — just one day after catalog inclusion. The EPSS score of 73.76% at the 99th percentile underscores near-certain exploitation, and this vulnerability has been associated with known ransomware campaigns, making immediate patching critical for all organizations running affected NetScaler appliances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| citrix | netscaler application delivery controller | >= 12.1, < 12.1-55.328; >= 13.1, < 13.1-37.235; >= 13.1, < 13.1-58.32; >= 14.1, < 14.1-43.56 |
| citrix | netscaler gateway | >= 13.1, < 13.1-58.32; >= 14.1, < 14.1-43.56 |
References
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420(Vendor Advisory)
- https://citrixbleed.com(Broken Link, Third Party Advisory)
- https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/(Third Party Advisory)
- https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/(Third Party Advisory)
- https://www.bleepingcomputer.com/news/security/cisa-tags-citrix-bleed-2-as-exploited-gives-agencies-a-day-to-patch/(Press/Media Coverage, Third Party Advisory)
- https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/(Third Party Advisory)
- https://www.theregister.com/2025/07/10/cisa_citrixbleed_kev/(Press/Media Coverage)
- https://doublepulsar.com/citrixbleed-2-exploitation-started-mid-june-how-to-spot-it-f3106392aa71(Third Party Advisory)
- https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-5777(US Government Resource)
Weakness Type
CWE-125: Out-of-bounds Read
In CVE-2025-5777, the NetScaler ADC and Gateway components perform memory read operations that extend beyond the intended buffer boundaries. This allows an attacker to extract data from adjacent memory regions, potentially exposing session tokens, authentication credentials, and other sensitive information stored in device memory.
Learn more: CWE-125 — Out-of-bounds Read
CWE-908: Use of Uninitialized Resource
The vulnerability also involves the use of uninitialized memory that may contain residual data from previous operations. When the NetScaler processes certain requests, it returns memory content that has not been properly cleared, enabling information leakage through crafted network requests.
Learn more: CWE-908 — Use of Uninitialized Resource
CWE-457: Use of Uninitialized Variable
CVE-2025-5777 further involves uninitialized variables in the request handling path that can be leveraged to read memory contents beyond the allocated buffer. This weakness contributes to the broader memory disclosure attack surface exploited in CitrixBleed 2.
Learn more: CWE-457 — Use of Uninitialized Variable
Impact Analysis
CVE-2025-5777 poses a severe confidentiality risk to organizations relying on Citrix NetScaler ADC and Gateway for VPN access, application delivery, and authentication services. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requiring no authentication (PR:N) and no user interaction (UI:N), meaning any internet-facing NetScaler appliance configured as a Gateway or AAA virtual server is immediately at risk. Confidentiality impact is high (C:H) because attackers can extract session tokens, authentication cookies, and credentials directly from device memory, enabling session hijacking and unauthorized access to internal networks. While integrity and availability are not directly impacted by the memory disclosure itself, the stolen session data enables subsequent attacks including lateral movement and data exfiltration. The EPSS score of 73.76% places this vulnerability in the top 1% of all CVEs for exploitation probability, and its confirmed association with ransomware campaigns elevates the urgency — threat actors are actively weaponizing CitrixBleed 2 to gain initial access for ransomware deployment across enterprise environments.
Exploit Maturity
CVE-2025-5777 exhibits extremely high exploit maturity, with CISA confirming active exploitation and issuing a one-day remediation deadline — the shortest possible timeline — reflecting the severity of ongoing attacks. Public exploit analysis and technical write-ups are available from multiple security research firms, including Horizon3.ai and watchTowr Labs, which detail the exploitation mechanism. According to DoublePulsar research, exploitation began in mid-June 2025, weeks before the public disclosure. The EPSS score of 73.76% at the 99th percentile indicates near-certain ongoing exploitation activity. This vulnerability is associated with known ransomware campaigns, following the pattern established by the original CitrixBleed (CVE-2023-4966), which was heavily exploited by LockBit and other ransomware groups. Organizations should assume that any unpatched, internet-facing NetScaler appliance has already been compromised.
Remediation
-
Apply the vendor patch immediately. Citrix has released security updates addressing CVE-2025-5777. Upgrade NetScaler ADC to version 12.1-55.328, 13.1-37.235, 13.1-58.32, or 14.1-43.56 (depending on your branch), and NetScaler Gateway to version 13.1-58.32 or 14.1-43.56. Refer to CTX693420 for detailed upgrade guidance.
-
Invalidate all active sessions and rotate credentials after patching. Because the vulnerability leaks session tokens from memory, existing sessions may be compromised. Force all users to re-authenticate and rotate any API keys, certificates, or service account credentials that may have been exposed through the appliance.
-
Conduct a forensic investigation on all NetScaler appliances that were running vulnerable versions while internet-facing. Review web server and AAA logs for anomalous access patterns, check for unauthorized configuration changes, and look for indicators of compromise documented by ReliaQuest and DoublePulsar.
-
Restrict network access to the NetScaler management interface and limit VPN virtual server exposure where possible. Implement WAF rules and network monitoring to detect exploitation attempts targeting memory disclosure patterns.
-
Implement memory-safe operational practices for network appliances by enabling enhanced logging, deploying network detection and response (NDR) solutions to monitor for data exfiltration, and establishing a rapid patching process for future critical vulnerabilities in perimeter devices.
Technical Details
CVE-2025-5777 is a memory disclosure vulnerability in Citrix NetScaler ADC and NetScaler Gateway caused by a combination of out-of-bounds read (CWE-125), use of uninitialized resources (CWE-908), and use of uninitialized variables (CWE-457). The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N reflects a network-accessible attack with no authentication or user interaction requirements that exclusively impacts confidentiality. The vulnerability manifests when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. Insufficient input validation in the request processing pipeline causes the application to perform memory read operations that extend beyond allocated buffer boundaries, returning uninitialized memory content that may contain session tokens, authentication cookies, and other sensitive data from previous operations. The attack mechanism is analogous to the original CitrixBleed (CVE-2023-4966), where specially crafted HTTP requests trigger the appliance to leak adjacent memory contents in its response. The affected versions span NetScaler ADC 12.1 through 14.1 and NetScaler Gateway 13.1 through 14.1, with fixes delivered in point releases that implement proper bounds checking and memory initialization for the vulnerable code paths.
Frequently Asked Questions
Is CVE-2025-5777 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2025-5777 and added it to the Known Exploited Vulnerabilities catalog with an emergency one-day remediation deadline. Multiple security research firms have documented exploitation activity dating back to mid-June 2025, and the vulnerability is associated with known ransomware campaigns.
What products are affected by CVE-2025-5777?
Citrix NetScaler ADC versions 12.1 through 14.1 and NetScaler Gateway versions 13.1 through 14.1 are affected when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Specific fix versions are NetScaler ADC 12.1-55.328, 13.1-37.235, 13.1-58.32, 14.1-43.56 and NetScaler Gateway 13.1-58.32, 14.1-43.56.
How do I fix CVE-2025-5777?
Upgrade to the patched NetScaler version for your branch immediately, then invalidate all active sessions, rotate credentials, and conduct a forensic review. Refer to Citrix advisory CTX693420 for specific version guidance.
How severe is CVE-2025-5777?
With a CVSS score of 7.5 (High) and an EPSS score of 73.76% at the 99th percentile, CVE-2025-5777 is among the most actively exploited vulnerabilities. Its association with ransomware campaigns and the original CitrixBleed attack pattern makes it a critical priority for remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.