CVE-2025-5777: Citrix NetScaler ADC/Gateway memory overread via insufficient input validation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.3, unauthenticated network reachability, CISA KEV listing with known ransomware use, and near-maximum EPSS probability make this an urgent patch-first issue.

What it is

CVE-2025-5777 is an insufficient input validation flaw in Citrix NetScaler ADC and NetScaler Gateway that causes a memory overread when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. It is tracked as CitrixBleed 2 and has been added to CISA KEV, with a CVSS 4.0 base score of 9.3 (critical).

Impact

An unauthenticated remote attacker can read memory contents from the appliance, which can expose session tokens and other sensitive data. Because the flaw is network-reachable and requires no privileges or user interaction, it can lead to credential/session theft and follow-on access to protected resources.

Attack surface

Reachable over the network via the NetScaler Gateway or AAA virtual server interfaces; the CVSS 4.0 vector shows AV:N/PR:N/UI:N, so no authentication or user interaction is required. Only deployments configured as Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual servers are affected.

Exploitation

CISA added CVE-2025-5777 to KEV on 2025-07-10 with a due date of 2025-07-11 and flags known ransomware campaign use; EPSS 30-day probability is 0.99964 (99.975th percentile). Multiple third-party advisories and press coverage describe active exploitation.

What to do

• Apply the Citrix vendor security update referenced in CTX693420 immediately; this is the primary fix.
• If patching cannot be completed, follow Citrix mitigation guidance or discontinue use of the affected Gateway/AAA virtual server configuration.
• Rotate credentials and invalidate active sessions on affected appliances after patching, since memory disclosure can expose session tokens.
• Restrict network exposure of NetScaler Gateway/AAA virtual servers to trusted sources where operationally feasible.
• Monitor CISA KEV/BOD 22-01 guidance for cloud-hosted instances and apply the same remediation timeline.

Detection

• Review NetScaler ADC/Gateway logs for anomalous or malformed requests to Gateway/AAA virtual servers around the June 2025 onward exploitation window.
• Hunt for unexpected session token reuse or authentication from unusual source IPs against NetScaler-protected resources.
• Monitor for post-exploitation activity such as new administrative accounts, configuration changes, or outbound connections from the appliance.
• Correlate NetScaler appliance telemetry with EDR/network logs for memory-disclosure probing patterns described in public CitrixBleed 2 write-ups.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.