What is the CVSS score of EUVD-2025-18497?

EUVD-2025-18497 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L. EPSS exploitation probability: 69.8%.

Is there a public PoC exploit available for EUVD-2025-18497?

Yes, a public proof-of-concept exploit is available for EUVD-2025-18497. Prioritise patching immediately. EPSS: 69.8%.

How to fix or mitigate EUVD-2025-18497?

Within 24 hours: Identify all Citrix NetScaler ADC and Gateway instances in production and confirm their current versions (vulnerable if running 14.1 prior to 14.1-43.56 or 13.1 prior to 13.1-58.32); enable enhanced logging on affected appliances and review recent session token activity for anomalies. Within 7 days: Apply vendor-released patches immediately (upgrade to NetScaler ADC 14.1-43.56 or NetScaler Gateway 13.1-58.32 or later), prioritizing internet-facing and VPN gateway instances; force re-authentication of all active sessions post-patch to invalidate potentially compromised tokens. Within 30 days: Conduct forensic review of gateway logs for evidence of token exfiltration or unauthorized session activity during the exposure window; implement network-based monitoring to detect anomalous VPN session behavior; validate patch application across all instances and document remediation completion.

NetScaler ADC EUVD-2025-18497

Q: Which versions of NetScaler ADC are affected by EUVD-2025-18497?

Citrix NetScaler ADC and Gateway appliances are under active attack for CVE-2025-5777, a critical vulnerability that leaks valid session credentials from memory, allowing attackers to hijack VPN and…. A patch is available.

| CVE-2025-5777 CRITICAL

Out-of-bounds Read (CWE-125)

2025-06-17 secure@citrix.com

Buffer Overflow Information Disclosure Citrix Netscaler Application Delivery Controller Netscaler Gateway

9.3

CVSS 4.0 · Vendor: citrix

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify internet-facing NetScaler Gateway/AAA vserver
Delivery

Send crafted request to login endpoint
Exploit

Trigger out-of-bounds memory read
Execution

Extract leaked session tokens from response
Persist

Replay token to hijack authenticated session
Impact

Access internal resources bypassing MFA

Vulnerability Assessment

Weakness	CWE CWE-125 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, read limits MITRE ATT&CK 1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The NetScaler must be configured as a Gateway - specifically a VPN virtual server, ICA Proxy, CVPN, or RDP Proxy - OR as an AAA (authentication) virtual server; appliances deployed purely for load balancing without these roles do not expose the vulnerable login handler. Given the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, user interaction, or special client positioning is required once such a virtual server is internet-reachable - exploitation is remote and unauthenticated against the login endpoint. The primary limiting factor is therefore deployment role and network exposure: only devices with a Gateway or AAA vserver reachable by the attacker are exploitable, and only unpatched 13.1 (<58.32) and 14.1 (<43.56) firmware is affected.
Impact	This is a genuine top-tier priority, not an inflated high-CVSS score. Every real-world signal aligns: the CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N (network, low complexity, no privileges, no user interaction), EPSS is 69.81% at the 99th percentile, a public exploit exists, and CISA added it to the KEV catalog with a one-day patch deadline for federal agencies - indicating urgent, widespread concern. Multiple independent research writeups (watchTowr, Horizon3, ReliaQuest, DoublePulsar) corroborate exploitation reportedly beginning mid-June 2025. One nuance to flag: the vendor CVSS marks VI:H/VA:H (integrity/availability high), but the underlying defect is an out-of-bounds READ whose direct technical impact is confidentiality; the integrity/availability consequences are indirect, arising from hijacking sessions with leaked tokens rather than from the memory read itself. Defenders should treat the confidentiality leak plus session-token theft as the concrete threat.
Exploit ScenarioDerived	An attacker sends specially crafted requests to the public-facing login endpoint of a NetScaler configured as a Gateway or AAA virtual server and receives responses containing leaked appliance memory. By repeating the request, they harvest valid session tokens and replay them to hijack an authenticated user's VPN/gateway session, bypassing MFA. Public exploit code and multiple technical writeups make this trivially reproducible against exposed, unpatched devices.

Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.

Exploited in the wild (CISA KEV) Patch available 69.8% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Aug 04, 2026

Memory overread in Citrix NetScaler ADC and NetScaler Gateway (versions before 14.1-43.56 and 13.1-58.32) lets remote unauthenticated attackers leak uninitialized memory contents - including session tokens and other secrets - from the appliance's login endpoint when it is deployed as a Gateway or AAA virtual server. Dubbed 'CitrixBleed 2,' it is confirmed actively exploited (CISA KEV), publicly available exploit code exists, and it carries an EPSS score of 69.81% (99th percentile), placing it among the most likely-to-be-exploited CVEs. Leaked tokens enable session hijacking and MFA bypass, effectively granting attacker access to authenticated VPN/gateway sessions.

Earlier versions of this analysis (1)

v1 Mar 14, 2026 - 22:15 CVSS 7.5

NetScaler ADC and Gateway contain an insufficient input validation vulnerability (CWE-125) that causes memory overread, exposing sensitive data from the appliance's memory to unauthenticated remote attackers when configured as Gateway or AAA virtual server.

RemediationAI

Vendor-released patch: upgrade to NetScaler ADC/Gateway 14.1-43.56 or later on the 14.1 branch, and 13.1-58.32 or later on the 13.1 branch, per Citrix advisory CTX693420 (https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420). Because leaked session tokens survive a patch, after upgrading you must terminate all active ICA and PCoIP sessions ('kill icaconnection -all' and 'kill pcoipConnection -all') to invalidate any tokens attackers may have already harvested, then rotate credentials and review authentication logs for anomalous reuse. There is no adequate configuration-only workaround for the memory read itself; if immediate patching is impossible, restrict reachability of the Gateway/AAA virtual server to trusted networks or place it behind a WAF/reverse proxy that can filter malformed login requests (trade-off: may break legitimate remote-access flows), and monitor for repeated login POSTs returning oversized responses. Retire unsupported 12.1/13.0 appliances.

Affected VersionsENISA

Gateway 13.1 <58.32

ADC 14.1 <43.56

Gateway 14.1 <43.56

ADC 13.1 <58.32

Affected Packages

euvd adc fix: 43.56, 58.32

euvd gateway fix: 43.56, 58.32

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 2 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway are enterprise application-delivery and remote-access appliances that terminate VPN, ICA Proxy, CVPN, RDP Proxy and AAA authentication traffic. The root cause is CWE-125 (Out-of-bounds Read): insufficient input validation on data submitted to the login/authentication handler causes the appliance to return more bytes than were legitimately populated, exposing adjacent uninitialized process memory in the HTTP response. Because that memory region frequently contains active session material, the flaw functions as a confidentiality leak that echoes the original 2023 'CitrixBleed' (CVE-2023-4966), hence the '2' moniker. Affected CPEs cover citrix:netscaler_application_delivery_controller (standard, FIPS, and NDcPP editions) and citrix:netscaler_gateway.

Know when Netscaler Application Delivery Controller gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (citrix) PRIMARY 9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

vuln.today AI 7.5 HIGH

Remote, unauthenticated, no interaction against an exposed login endpoint; direct impact of an out-of-bounds read is memory disclosure, so confidentiality High and integrity/availability None.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (citrix).

CVSS VectorVendor: citrix

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

High

Subsequent system: Confidentiality

Low

Subsequent system: Integrity

Low

Subsequent system: Availability

Low

Lifecycle Timeline

Severity Changed

Aug 04, 2026 - 05:22 NVD

HIGH CRITICAL

CVSS changed

Aug 04, 2026 - 05:22 NVD

7.5 (HIGH) 9.3 (CRITICAL)

Patch available

Apr 16, 2026 - 05:29 EUVD

58.32,43.56

Added to CISA KEV

Oct 30, 2025 - 20:10 cisa

CISA KEV

PoC Detected

Oct 30, 2025 - 20:10 vuln.today

Public exploit code

CVE Published

Jun 17, 2025 - 13:15 nvd

HIGH 7.5

DescriptionCVE.org

Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

Executive ViewAI

Why It Matters

Citrix NetScaler ADC and Gateway appliances are under active attack for CVE-2025-5777, a critical vulnerability that leaks valid session credentials from memory, allowing attackers to hijack VPN and gateway sessions without knowing user passwords or bypassing MFA protections. This vulnerability is confirmed actively exploited (CISA KEV) with an exploitation probability in the 99th percentile, meaning most organizations running affected versions face immediate compromise risk. Attackers bypassing authentication controls over your network perimeter represents a critical threat to both data confidentiality and remote access availability for all users.

Business Impact: Severe

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

Threat Score

7.0/10

Composite threat intelligence

EPSS Score

69.8%

Top 1% exploitable

Prevalence

High

widely deployed enterprise remote-access appliance in large organizations

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD Citrix

NVD

CVE.org

CISA KEV

EPSS CERT-EU POC (1)

Exploit-DB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV Yes

Public POC Yes

EPSS 69.8%

Patch available Yes

Active threat Yes

Deciding rule

In CISA KEV with patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Immediate

Exploitation· derived

Active

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

186

Low Medium High Critical

KEV: +50

EPSS: +70

CVSS: +46

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.