KEV catalog · CISA Known Exploited Vulnerabilities
CVE-2025-5777
7.5
3-Day Required
PoC Available
KEV
Automatable
Active Exploitation
Details
VulnerabilityCitrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability
VendorCitrix
ProductNetScaler ADC and Gateway
Date added2025-07-10
Due date2025-07-11
CISA catalogView on CISA KEV catalog
Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CWECWE-125 CWE-457 CWE-908
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Descriptions
KEV: Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.
NVD: Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
Compliance SSVC + BOD 26-04
Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required
Research metadata
Last researched2026-06-18 08:01 UTC
Searches25
Component defaultno
Sources
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420
https://nvd.nist.gov/vuln/detail/CVE-2025-5777
https://www.cve.org/cverecord?id=CVE-2025-5777
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/
https://horizon3.ai/attack-research/vulnerabilities/cve-2025-5777/
https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/
https://www.splunk.com/en_us/blog/security/citrixbleed-vulnerability-detection-mitigation.html
https://www.tenable.com/blog/cve-2025-5777-cve-2025-6543-frequently-asked-questions-about-citrixbleed-2
https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/
https://arcticwolf.com/resources/blog/cve-2025-5777/
https://arcticwolf.com/resources/blog/follow-up-updates-on-actively-exploited-information-disclosure-vulnerability-citrix-bleed-2-in-citrix-netscaler-adc-and-gateway-cve-2025-5777/
https://www.picussecurity.com/resource/blog/cve-2025-5777-citrix-bleed-2-memory-leak-vulnerability-explained
https://censys.com/advisory/cve-2025-5777-cve-2025-6543-cve-2025-5439/
https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/
https://hadrian.io/blog/cve-2025-5777-a-new-memory-leak-in-citrix-gateway-devices
https://www.cyfirma.com/research/cve-2025-5777-pre-auth-memory-leak-in-citrix-netscaler-citrixbleed-2/
https://advisories.checkpoint.com/defense/advisories/public/2025/cpai-2025-0491.html/
https://www.imperva.com/blog/cve-2025-5777-exposes-citrix-netscaler-to-dangerous-memory-leak-attacks/
https://www.akamai.com/blog/security-research/mitigating-citrixbleed-memory-vulnerability-ase
https://www.stormshield.com/news/security-alert-citrix-netscaler-cve-2025-5777-stormshield-products-response/
https://www.greynoise.io/blog/exploitation-citrixbleed-2-cve-2025-5777-before-public-poc
https://doublepulsar.com/citrixbleed-2-exploitation-started-mid-june-how-to-spot-it-f3106392aa71
https://socprime.com/blog/detect-cve-2025-5777-exploitation/
https://aws.amazon.com/blogs/security/amazon-discovers-apt-exploiting-cisco-and-citrix-zero-days/
https://www.helpnetsecurity.com/2025/07/08/cve-2025-5777-indicators-of-compromise/
https://thehackernews.com/2025/07/cisa-adds-citrix-netscaler-cve-2025.html
https://www.aha.org/system/files/media/file/2025/07/h-isac-tlp-white-threat-bulletin-poc-exploits-available-for-citrix-netscaler-adc-and-netscaler-gateway-flaw-cve-2025-5777-7-9-2025.pdf
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5777.yaml
https://safeguard.sh/resources/blog/citrix-bleed-2-analysis
https://www.sentinelone.com/vulnerability-database/cve-2025-5777/
https://www.cyber.gc.ca/en/alerts-advisories/vulnerabilities-impacting-citrix-netscaler-adc-netscaler-gateway-cve-2025-5349-cve-2025-5777-cve-2025-6543
https://docs.netscaler.com/en-us/netscaler-application-delivery-management-software/current-release/instance-advisory/remediate-vulnerabilities-cve-2025-5777.html
https://medium.com/@knownsec404team/root-cause-analysis-of-the-citrixbleed-2-cve-2025-5777-vulnerability-dc7278bd5ffb
https://nvd.nist.gov/vuln/detail/CVE-2025-5777
https://www.cve.org/cverecord?id=CVE-2025-5777
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/
https://horizon3.ai/attack-research/vulnerabilities/cve-2025-5777/
https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/
https://www.splunk.com/en_us/blog/security/citrixbleed-vulnerability-detection-mitigation.html
https://www.tenable.com/blog/cve-2025-5777-cve-2025-6543-frequently-asked-questions-about-citrixbleed-2
https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/
https://arcticwolf.com/resources/blog/cve-2025-5777/
https://arcticwolf.com/resources/blog/follow-up-updates-on-actively-exploited-information-disclosure-vulnerability-citrix-bleed-2-in-citrix-netscaler-adc-and-gateway-cve-2025-5777/
https://www.picussecurity.com/resource/blog/cve-2025-5777-citrix-bleed-2-memory-leak-vulnerability-explained
https://censys.com/advisory/cve-2025-5777-cve-2025-6543-cve-2025-5439/
https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/
https://hadrian.io/blog/cve-2025-5777-a-new-memory-leak-in-citrix-gateway-devices
https://www.cyfirma.com/research/cve-2025-5777-pre-auth-memory-leak-in-citrix-netscaler-citrixbleed-2/
https://advisories.checkpoint.com/defense/advisories/public/2025/cpai-2025-0491.html/
https://www.imperva.com/blog/cve-2025-5777-exposes-citrix-netscaler-to-dangerous-memory-leak-attacks/
https://www.akamai.com/blog/security-research/mitigating-citrixbleed-memory-vulnerability-ase
https://www.stormshield.com/news/security-alert-citrix-netscaler-cve-2025-5777-stormshield-products-response/
https://www.greynoise.io/blog/exploitation-citrixbleed-2-cve-2025-5777-before-public-poc
https://doublepulsar.com/citrixbleed-2-exploitation-started-mid-june-how-to-spot-it-f3106392aa71
https://socprime.com/blog/detect-cve-2025-5777-exploitation/
https://aws.amazon.com/blogs/security/amazon-discovers-apt-exploiting-cisco-and-citrix-zero-days/
https://www.helpnetsecurity.com/2025/07/08/cve-2025-5777-indicators-of-compromise/
https://thehackernews.com/2025/07/cisa-adds-citrix-netscaler-cve-2025.html
https://www.aha.org/system/files/media/file/2025/07/h-isac-tlp-white-threat-bulletin-poc-exploits-available-for-citrix-netscaler-adc-and-netscaler-gateway-flaw-cve-2025-5777-7-9-2025.pdf
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5777.yaml
https://safeguard.sh/resources/blog/citrix-bleed-2-analysis
https://www.sentinelone.com/vulnerability-database/cve-2025-5777/
https://www.cyber.gc.ca/en/alerts-advisories/vulnerabilities-impacting-citrix-netscaler-adc-netscaler-gateway-cve-2025-5349-cve-2025-5777-cve-2025-6543
https://docs.netscaler.com/en-us/netscaler-application-delivery-management-software/current-release/instance-advisory/remediate-vulnerabilities-cve-2025-5777.html
https://medium.com/@knownsec404team/root-cause-analysis-of-the-citrixbleed-2-cve-2025-5777-vulnerability-dc7278bd5ffb
Hunting hypothesis agent
Hunt for malformed HTTP POST requests to /doAuthentication.do on Citrix NetScaler Gateway VPN or AAA virtual servers causing memory overread and leakage of session tokens.
Research details
ComponentNetScaler ADC (all form factors: VPX, MPX, SDX, BLX) and NetScaler Gateway configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server — the /doAuthentication.do and /p endpoints on ports 443/80
PreconditionsNetwork reachability to the Citrix NetScaler ADC or Gateway device on port 443 (HTTPS) or port 80 (HTTP); Target must be running a vulnerable version (NetScaler ADC/Gateway 14.1 before 14.1-43.56, 13.1 before 13.1-58.32, 13.1-FIPS before 13.1-37.235, 13.1-NDcPP before 13.1-37.235, 12.1 before 12.1-55.328 FIPS; versions 12.1 and 13.0 are End-of-Life and remain vulnerable without mitigation); Must be configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server; No authentication or prior access required (pre-auth); Attack surface is exposed via the /doAuthentication.do and /p endpoints accepting HTTP POST requests; Exploitation requires sending a crafted malformed HTTP POST request body to the vulnerable endpoint, causing the server to return response data containing leaked uninitialized memory including active session tokens (NSC_AAAC, NSC_TMAS, NS-TOKEN cookies), enabling session hijacking and MFA bypass; Exploitation was observed in the wild prior to public disclosure — GreyNoise detected scanning from mid-June 2025, and Amazon MadPot honeypot detected an advanced APT group exploiting it as a zero-day; Multiple public PoCs, automated scanning templates (Nuclei), and commercial exploit framework modules (Core Impact) are widely available. agent
DeliveryHTTP POST request to vulnerable NetScaler endpoint (/doAuthentication.do or /p) with a crafted/malformed request body, causing server to read out-of-bounds memory and reflect contents in the HTTP response
Public PoCyes
PoC URLs
https://github.com/0xgh057r3c0n/CVE-2025-5777
https://github.com/nocerainfosec/cve-2025-5777
https://github.com/oways/CitrixBleed2_POC
https://github.com/RickGeex/CVE-2025-5777-CitrixBleed
https://github.com/bughuntar/CVE-2025-5777
https://github.com/rootxsushant/Citrix-NetScaler-Memory-Leak-CVE-2025-5777
https://github.com/RaR1991/citrix_bleed_2
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5777.yaml Third-party repos; verify before use.
https://github.com/nocerainfosec/cve-2025-5777
https://github.com/oways/CitrixBleed2_POC
https://github.com/RickGeex/CVE-2025-5777-CitrixBleed
https://github.com/bughuntar/CVE-2025-5777
https://github.com/rootxsushant/Citrix-NetScaler-Memory-Leak-CVE-2025-5777
https://github.com/RaR1991/citrix_bleed_2
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5777.yaml Third-party repos; verify before use.
Exploit notesCVSS:3.1 base score 7.5 (HIGH) per NVD, but Citrix assigned CVSS:4.0 9.3 (CRITICAL) in their own advisory (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L). Attack complexity is LOW — exploitation requires no authentication, no user interaction, and can be performed remotely. Multiple public PoC exploits and automated scanner templates (Nuclei) are widely available. Core Impact commercial exploit framework includes an exploit module. Exploitation was observed in the wild prior to public disclosure. The vulnerability is trivially exploitable by sending a crafted HTTP POST request to the vulnerable endpoint with a malformed body, causing the server to return a response containing leaked memory contents including session tokens.
SummaryCVE-2025-5777, dubbed 'CitrixBleed 2' (successor to CVE-2023-4966/CitrixBleed), is a critical out-of-bounds read / memory disclosure vulnerability in Citrix NetScaler ADC and Gateway appliances. The vulnerability exists due to insufficient input validation of HTTP POST requests to the /doAuthentication.do endpoint (and related endpoints like /p), specifically when the device is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. An unauthenticated remote attacker can craft a malformed HTTP POST request which causes the server to return response data containing fragments of uninitialized memory, including active session tokens, authentication cookies (e.g., NSC_AAAC, NSC_TMAS, or NS-TOKEN), and other sensitive data. Exploitation enables session hijacking, MFA bypass, and lateral movement within the target network. Citrix published security bulletin CTX693420 on June 17, 2025, advising customers to upgrade to fixed versions (14.1-43.56, 13.1-58.32, 13.1-37.235 FIPS/NDcPP, or 12.1-55.328 FIPS). On July 4, 2025, watchTowr researchers publicly disclosed exploit details. On July 10, 2025, CISA added CVE-2025-5777 to its Known Exploited Vulnerabilities (KEV) catalog confirming active exploitation. GreyNoise observed exploitation attempts since mid-June 2025, prior to public PoC availability. Amazon's MadPot honeypot service detected an advanced APT group exploiting CVE-2025-5777 as a zero-day before public disclosure. Multiple PoCs are publicly available on GitHub, Nuclei templates exist for automated scanning, and the Core Impact framework includes a certified exploit module. Various IPS/IDS signatures exist including Check Point (CPAI-2025-0491), Snort SID 65120, Stormshield, and Splunk detection content. Akamai, Imperva, and other WAF vendors have released mitigations. Affected products include NetScaler ADC and NetScaler Gateway running versions 14.1 before 14.1-43.56, 13.1 before 13.1-58.32, 13.1-FIPS before 13.1-37.235, 13.1-NDcPP before 13.1-37.235, and 12.1 before 12.1-55.328 FIPS. End-of-life versions 12.1 and 13.0 remain vulnerable without mitigation. The vulnerability affects all NetScaler form factors (VPX, MPX, SDX, BLX).
Tia coverage
First reported2026-08-13
First exploit report2026-08-13
Exploit report → KEV399 days after the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.
Mentioned in
one-of-the-first-questions-suspectfile-asked-anubiswhen-patching-isn-t-enough-what-the-fairlife-ransomware-attack-s
Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.