High severity · published Jun 17, 2025
CVE-2025-5777
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
RansomwareIn wildKEV
7.5
CVSS
100%
EPSS
Yes
On KEV
Description
Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)100.0% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Jul 10, 2025
Federal remediation dueJul 11, 2025
Ransomware campaign useKnown
Affected products
Which versions
NA
NetScaler ADC · Citrix
12.1 before 12.1-55.328; 13.1 before 13.1-37.235; 13.1 before 13.1-37.235; 13.1 before 13.1-58.32; 14.1 before 14.1-43.56 · source: NVD
AD
ADC · NetScaler
14.1 before 43.56; 13.1 before 58.32 · source: vendor
GA
Gateway · NetScaler
14.1 before 43.56; 13.1 before 58.32 · source: vendor
NA
NetScaler ADC and Gateway · Citrix
All versions, or not specified · source: KEV
In the news
VulnerabilityCritical
Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials
Threat actors associated with the Anubis ransomware operation have been observed exploiting the Citrix Bleed 2 (CVE-2025-5777) vulnerability to obtain initial access.
"Although tactics differ between affiliates, common patterns emerged in tradecraft through use of legitimate Remote Management and Monitoring (RMM) tooling, credential access, and hands-on-keyboard procedures used for lateral
Jul 2, 2026·The Hacker News
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-5777
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-5777
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
support.citrix.com
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420
More from NetScaler ADC
9.8
CVE-2026-88771
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
9.8
CVE-2026-19490
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
9.8
CVE-2026-8452
Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service
9.8
CVE-2026-3055
Insufficient input validation leading to memory overread
9.8
CVE-2025-7775
Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service