CVE-2025-5777
This vulnerability allows attackers to read memory on Citrix NetScaler devices configured as Gateway or AAA virtual servers due to insufficient input validation. The flaw can be exploited remotely without authentication and can lead to disclosure of sensitive data. It is rated critical with a CVSS score of 9.3.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Citrix NetScaler Application Delivery Controller and NetScaler Gateway devices, especially those configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
Real-world impact
An attacker could read memory contents, potentially exposing confidential information such as credentials, configuration data, or other sensitive data stored in memory. This could lead to further compromise of the system.
Why this severity
The CVSS score of 9.3 reflects that the vulnerability can be exploited remotely without authentication, has high confidentiality, integrity, and availability impact, and is easy to exploit with low attack complexity.
What to do about it
- 01Review Citrix’s official guidance for CVE-2025-5777 and apply the recommended mitigation (e.g., update configuration or apply patch if available).
- 02If your deployment is in the cloud, also follow the BOD 22‑01 guidance for cloud services.
- 03If no mitigation is available, consider discontinuing use of the affected NetScaler product.
CISA KEV required action
Timeline
- Jun 17, 2025 · Jun 17, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 10, 2025 · Jul 10, 2025Confirmed exploited (CISA KEV)CISA added it to the Known Exploited Vulnerabilities catalog — attackers are using it in the wild.
- Jul 11, 2025 · Jul 11, 2025CISA remediation deadlineFederal agencies are required to remediate by this date.
- Aug 4, 2026 · 2d agoAdvisory updatedThe NVD record was last revised.
- Aug 4, 2026 · 2d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- support.citrix.com/support-home/kbsearch/artic…vendor advisory
- citrixbleed.combroken linkthird party advisory
- horizon3.ai/attack-research/attack-blog…third party advisory
- labs.watchtowr.com/how-much-more-must-we-bleed…third party advisory
- bleepingcomputer.com/news/security/cisa-tags-cit…press/media coveragethird party advisory
- netscaler.com/blog/news/netscaler-critica…third party advisory
- theregister.com/2025/07/10/cisa_citrixbleed…press/media coverage
- doublepulsar.com/citrixbleed-2-exploitation-…third party advisory
- reliaquest.com/blog/threat-spotlight-citri…third party advisory
- cisa.gov/known-exploited-vulnerabili…us government resource