Which versions of NetScaler ADC are affected by CVE-2025-5777?

Citrix NetScaler ADC and Gateway appliances are under active attack for CVE-2025-5777, a critical vulnerability that leaks valid session credentials from memory, allowing attackers to hijack VPN and…. A patch is available.

Is there a public PoC exploit available for CVE-2025-5777?

Yes, a public proof-of-concept exploit is available for CVE-2025-5777. Prioritise patching immediately. EPSS: 69.8%.

How to fix or mitigate CVE-2025-5777?

Within 24 hours: Identify all Citrix NetScaler ADC and Gateway instances in production and confirm their current versions (vulnerable if running 14.1 prior to 14.1-43.56 or 13.1 prior to 13.1-58.32); enable enhanced logging on affected appliances and review recent session token activity for anomalies. Within 7 days: Apply vendor-released patches immediately (upgrade to NetScaler ADC 14.1-43.56 or NetScaler Gateway 13.1-58.32 or later), prioritizing internet-facing and VPN gateway instances; force re-authentication of all active sessions post-patch to invalidate potentially compromised tokens. Within 30 days: Conduct forensic review of gateway logs for evidence of token exfiltration or unauthorized session activity during the exposure window; implement network-based monitoring to detect anomalous VPN session behavior; validate patch application across all instances and document remediation completion.

NetScaler ADC CVE-2025-5777

Q: What is the CVSS score of CVE-2025-5777?

CVE-2025-5777 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 69.8%.

EUVD-2025-18497 CRITICAL

Out-of-bounds Read (CWE-125)

2025-06-17 secure@citrix.com

Information Disclosure Citrix Netscaler Gateway Netscaler Application Delivery Controller Buffer Overflow

9.3

CVSS 4.0 · Vendor: citrix

Severity by source

Vendor (citrix) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote, unauthenticated, no interaction against an exposed login endpoint; direct impact of an out-of-bounds read is memory disclosure, so confidentiality High and integrity/availability None.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (citrix).

CVSS VectorVendor: citrix

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Aug 04, 2026 - 05:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 04, 2026 - 05:22 vuln.today

cvss_changed

Severity Changed

Aug 04, 2026 - 05:22 NVD

HIGH CRITICAL

CVSS changed

Aug 04, 2026 - 05:22 NVD

7.5 (HIGH) 9.3 (CRITICAL)

Analysis Updated

Apr 16, 2026 - 06:38 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

58.32,43.56

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18497

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

Added to CISA KEV

Oct 30, 2025 - 20:10 cisa

CISA KEV

PoC Detected

Oct 30, 2025 - 20:10 vuln.today

Public exploit code

CVE Published

Jun 17, 2025 - 13:15 nvd

HIGH 7.5

DescriptionCVE.org

Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

AnalysisAI

Memory overread in Citrix NetScaler ADC and NetScaler Gateway (versions before 14.1-43.56 and 13.1-58.32) lets remote unauthenticated attackers leak uninitialized memory contents - including session tokens and other secrets - from the appliance's login endpoint when it is deployed as a Gateway or AAA virtual server. Dubbed 'CitrixBleed 2,' it is confirmed actively exploited (CISA KEV), publicly available exploit code exists, and it carries an EPSS score of 69.81% (99th percentile), placing it among the most likely-to-be-exploited CVEs. Leaked tokens enable session hijacking and MFA bypass, effectively granting attacker access to authenticated VPN/gateway sessions.

Technical ContextAI

NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway are enterprise application-delivery and remote-access appliances that terminate VPN, ICA Proxy, CVPN, RDP Proxy and AAA authentication traffic. The root cause is CWE-125 (Out-of-bounds Read): insufficient input validation on data submitted to the login/authentication handler causes the appliance to return more bytes than were legitimately populated, exposing adjacent uninitialized process memory in the HTTP response. Because that memory region frequently contains active session material, the flaw functions as a confidentiality leak that echoes the original 2023 'CitrixBleed' (CVE-2023-4966), hence the '2' moniker. Affected CPEs cover citrix:netscaler_application_delivery_controller (standard, FIPS, and NDcPP editions) and citrix:netscaler_gateway.

RemediationAI

Vendor-released patch: upgrade to NetScaler ADC/Gateway 14.1-43.56 or later on the 14.1 branch, and 13.1-58.32 or later on the 13.1 branch, per Citrix advisory CTX693420 (https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420). Because leaked session tokens survive a patch, after upgrading you must terminate all active ICA and PCoIP sessions ('kill icaconnection -all' and 'kill pcoipConnection -all') to invalidate any tokens attackers may have already harvested, then rotate credentials and review authentication logs for anomalous reuse. There is no adequate configuration-only workaround for the memory read itself; if immediate patching is impossible, restrict reachability of the Gateway/AAA virtual server to trusted networks or place it behind a WAF/reverse proxy that can filter malformed login requests (trade-off: may break legitimate remote-access flows), and monitor for repeated login POSTs returning oversized responses. Retire unsupported 12.1/13.0 appliances.