{"id":"CVE-2025-5777","published":"2025-06-17T13:15:21Z","modified":"2026-10-08T10:35:53Z","title":"Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability","vendor":"Citrix","product":"NetScaler ADC and Gateway","tier":"core","eol":null,"description":{"text":"Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server","provenance":"source","from":"NVD"},"summary":{"text":"Citrix NetScaler ADC and Gateway contain an out-of-bounds read flaw caused by insufficient input validation, affecting deployments configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. An attacker with network access can trigger a memory overread without authentication or user interaction, potentially disclosing sensitive information from device memory.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:55:45Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.99972,"percentile":0.99978,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-07-10","dueDate":"2025-07-11","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420 ; https://nvd.nist.gov/vuln/detail/CVE-2025-5777","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-06-26","exploitedFirstSeen":"2025-06-26","ransomware":true,"evidence":[{"url":"https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/","date":"2025-06-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-02&host_type=src&vulnerability=cve-2025-5777","date":"2025-07-02"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-03&host_type=src&vulnerability=cve-2025-5777","date":"2025-07-03"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-04&host_type=src&vulnerability=cve-2025-5777","date":"2025-07-04"},{"url":"https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/","date":"2025-07-04"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-05&host_type=src&vulnerability=cve-2025-5777","date":"2025-07-05"},{"url":"https://app.crowdsec.net/cti/cve-explorer/CVE-2025-5777","date":"2025-07-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-06&host_type=src&vulnerability=cve-2025-5777","date":"2025-07-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-07&host_type=src&vulnerability=cve-2025-5777","date":"2025-07-07"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-08&host_type=src&vulnerability=cve-2025-5777","date":"2025-07-08"}],"evidenceTotal":508,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-908","name":"Use of Uninitialized Resource"},{"id":"CWE-125","name":"Out-of-bounds Read"}],"references":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420","tags":["Vendor Advisory"]},{"url":"https://citrixbleed.com","tags":["Broken Link","Third Party Advisory"]},{"url":"https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/","tags":["Third Party Advisory"]},{"url":"https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/","tags":["Third Party Advisory"]},{"url":"https://www.bleepingcomputer.com/news/security/cisa-tags-citrix-bleed-2-as-exploited-gives-agencies-a-day-to-patch/","tags":["Press/Media Coverage","Third Party Advisory"]},{"url":"https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/","tags":["Third Party Advisory"]},{"url":"https://www.theregister.com/2025/07/10/cisa_citrixbleed_kev/","tags":["Press/Media Coverage"]},{"url":"https://doublepulsar.com/citrixbleed-2-exploitation-started-mid-june-how-to-spot-it-f3106392aa71","tags":["Third Party Advisory"]},{"url":"https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-5777","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Out-of-Bounds (Read and Write)","mappingType":"exploitation_technique","evidence":[],"comment":"This memory leak vulnerability in Citrix NetScaler/ADC Gateway devices can be leveraged by sending malicious authentication requests, leaking sensitive information.","confidence":"high"},{"id":"T1555","name":"Credentials from Password Stores","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Out-of-Bounds (Read and Write)","mappingType":"primary_impact","evidence":[],"comment":"This memory leak vulnerability in Citrix NetScaler/ADC Gateway devices can be leveraged by sending malicious authentication requests, leaking sensitive information.","confidence":"high"}],"reports":[{"id":"SRC-6456fe61781512dde412","title":"MuddyWater Exposed: Inside an Iranian APT operation - Ctrl-Alt-Intel","publisher":"ctrlaltintel.com","url":"https://ctrlaltintel.com/research/MuddyWater/","date":"2026-03-04","mentions":[{"quote":"CVE-2025-5777 - Citrix NetScaler memory leak","start":4310,"end":4354}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-18497","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-18497","exploited":true,"exploitedSince":"2025-07-10","provenance":"source"},"exploits":[{"id":52401,"url":"https://www.exploit-db.com/exploits/52401","title":"Citrix NetScaler ADC/Gateway 14.1 - Memory Disclosure","type":"remote","platform":"multiple","date":"2025-08-11","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2025-08-11"},"pocGithub":{"count":23,"skipped":3,"earliest":"2025-06-30","earliestUrl":"https://github.com/mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC-","repos":[{"name":"win3zz/CVE-2025-5777","url":"https://github.com/win3zz/CVE-2025-5777","stars":50,"created":"2025-07-08"},{"name":"bughuntar/CVE-2025-5777","url":"https://github.com/bughuntar/CVE-2025-5777","stars":31,"created":"2025-07-10"},{"name":"mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC-","url":"https://github.com/mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC-","stars":17,"created":"2025-06-30"},{"name":"Chocapikk/CVE-2025-5777","url":"https://github.com/Chocapikk/CVE-2025-5777","stars":7,"created":"2025-07-08"},{"name":"soltanali0/CVE-2025-5777-Exploit","url":"https://github.com/soltanali0/CVE-2025-5777-Exploit","stars":5,"created":"2025-08-07"}]},"nuclei":[{"id":"CVE-2025-5777","name":"Citrix NetScaler Memory Disclosure - CitrixBleed 2","severity":"critical","path":"http/cves/2025/CVE-2025-5777.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5777.yaml"}],"first":{"date":"2025-06-30","source":"PoC-in-GitHub","url":"https://github.com/mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC-"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1555"],"provenance":"source"}],"timeline":[{"date":"2025-06-17","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5777","provenance":"source"},{"date":"2025-06-26","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/","provenance":"source"},{"date":"2025-06-30","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2025-08-11","url":"https://github.com/mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC-","provenance":"source"},{"date":"2025-07-10","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-07-10","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-18497","provenance":"source"},{"date":"2026-03-04","kind":"report","label":"Named in ctrlaltintel.com: MuddyWater Exposed: Inside an Iranian APT operation - Ctrl-Alt-Intel","url":"https://ctrlaltintel.com/research/MuddyWater/","provenance":"machine"}],"speed":{"daysToPublicExploit":13,"firstExploitFrom":"PoC-in-GitHub","daysToKev":23},"priority":{"score":82.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 492 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9998"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 23 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}