What is CVE-2025-5777?
Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
The record classifies CVE-2025-5777 under weakness classes CWE-125, CWE-908, CWE-457. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs no user interaction, and has high impact on confidentiality. 4 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 480 days ago.
Severity and exploitation probability
- CVSS v3.1 base score
- 7.5 — HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS v4.0 base score
- 9.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS (FIRST)
- 99.9% probability of exploitation in the next 30 days, higher than 99.9% of all scored CVEs
- CISA KEV
- Listed since 2025-07-10, federal remediation deadline 2025-07-11 — used in known ransomware campaigns
- Threadlinqs priority
- 10/10 — CISA lists it as used in ransomware, which Threadlinqs scores at the maximum
- Published
- 2025-06-17, last modified 2026-10-07
Is CVE-2025-5777 being exploited?
CISA added CVE-2025-5777 to the Known Exploited Vulnerabilities catalog on 2025-07-10, which means the agency holds evidence of exploitation in the wild; US federal civilian agencies had to remediate it by 2025-07-11 under BOD 22-01. CISA flags the vulnerability as one used in known ransomware campaigns. Weaponised exploit code for CVE-2025-5777 is publicly available. 11 public proof-of-concept repositories are tracked for this identifier. A ProjectDiscovery Nuclei detection template exists (http/cves/2025/CVE-2025-5777.yaml). It currently carries a trending score of 50 in the Threadlinqs vulnerability feed.
- win3zz/CVE-2025-5777 (github)
- bughuntar/CVE-2025-5777 (github)
- mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC- (github)
- Chocapikk/CVE-2025-5777 (github)
- Shivshantp/CVE-2025-5777-TrendMicro-ApexCentral-RCE (github)
- soltanali0/CVE-2025-5777-Exploit (github)
- nocerainfosec/cve-2025-5777 (github)
- cyberleelawat/ExploitVeer (github)
Affected products and versions
- Citrix: Netscaler Application Delivery Controller, Netscaler Gateway
Showing 2 of 4 recorded product entries.
How to fix CVE-2025-5777
Vendor advisory: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420. Because CVE-2025-5777 is KEV-listed, US federal civilian agencies were required to apply the vendor fix, or stop using the product, by 2025-07-11. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.
Threat activity tracking CVE-2025-5777
7 tracked threats in the Threadlinqs corpus reference CVE-2025-5777, either in the campaign’s CVE list or as an indicator on the campaign record.
- CISA Adds Two Citrix NetScaler Vulnerabilities (CVE-2026-88771, CVE-2026-88772) to KEV Catalog — CRITICAL · 2026-09-27
- Anubis Ransomware Group Confirms Data Theft in Coca-Cola Fairlife Attack Tied to CitrixBleed 2 (CVE-2025-5777) Exploitation Wave — CRITICAL · 2026-07-27
- CitrixBleed 2 (CVE-2025-5777) Weaponized by Initial Access Broker for DragonForce Ransomware Deployment — CRITICAL · 2026-07-09
- CitrixBleed-Class NetScaler ADC/Gateway SAML AuthnRequest Memory Disclosure (CVE-2026-8451) Exploited Within 24 Hours of Disclosure — CRITICAL · 2026-07-02
- Ransomware Groups Exploit Citrix Bleed 2 (CVE-2025-5777) and Kontron Driver BYOVD for Access and Privilege Escalation — CRITICAL · 2026-07-02
- CitrixBleed 3 — CVE-2026-3055 & CVE-2026-4368 NetScaler ADC/Gateway Memory Overread and Session Hijack — CRITICAL · 2026-04-17
- Citrix NetScaler Mass Reconnaissance Campaign via Residential Proxies — HIGH · 2026-02-03
Sources
Enriched from CVE.org, FIRST EPSS, CISA KEV, GitHub Security Advisories, public proof-of-concept repositories, ProjectDiscovery Nuclei. Last verified by Threadlinqs on .
Other references
Showing 5 of 10 recorded references.