Critical memory overread vulnerability in NetScaler ADC/Gateway allowing unauthenticated remote attackers to read sensitive memory contents including session tokens. Actively exploited in the wild with CISA KEV listing.
Data Source: CIRCL
Confidence: HIGH
Exploitation Method: DIRECT_NETWORK
CVE Published: 2025-06-17
Added to CISA KEV: 2025-07-10 23 DAYS BETWEEN CVE AND KEV
With PoC exploits for CVE-2025-5777 (aka CitrixBleed 2) now public and reports of active exploitation of the flaw since mid-June, you should check whether your Citrix NetScaler ADC and/or Gateway instances have been probed and compromised by attackers.
Citrix has fixed a critical vulnerability (CVE-2025-5777) in NetScaler ADC and Gateway that's reminiscent of the infamous CitrixBleed flaw.
It addresses Initial Access tactics, with the primary technique being the Exploitation of Public-Facing Applications (T1190). Additionally ...
To exploit the CVE-2025-5777 vulnerability, cyber attackers first identify NetScaler devices exposed on the internet.
CVE-2025-5777 Detail. Description. Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ...