CVE-2025-5777: Citrix NetScaler ADC and Gateway out-of-bounds read

CVE-2025-5777 · Severity: critical · CVSS 9.3 · Exploited in the wild · Published 2025-07-10

Citrix NetScaler ADC and Gateway appliances, which are used to manage network traffic and provide secure remote access, contain a critical security flaw. This vulnerability allows an attacker to read sensitive information from the device's memory without needing a password. This could lead to the theft of session tokens or other private data, potentially allowing unauthorized access to corporate networks. This issue is actively being exploited in the wild.

Technologies: Citrix Gateway, Citrix NetScaler ADC. Vendors: Citrix.

Quick answers

Is CVE-2025-5777 exploited in the wild?
Yes. CVE-2025-5777 is known to be exploited in the wild, first recorded on 10 July 2025. Treat it as urgent.
How severe is CVE-2025-5777?
Critical severity, with a CVSS score of 9.3, published 10 July 2025.
Which products and versions are affected?
Citrix NetScaler ADC; Citrix NetScaler Gateway.
Is there a fix for CVE-2025-5777?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-5777 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-5777?
Check whether you run Citrix Gateway, Citrix NetScaler ADC or Citrix NetScaler Gateway. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read vulnerability exists in Citrix NetScaler ADC and Gateway due to insufficient input validation. The flaw is triggered when the device is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server. A remote, unauthenticated attacker can exploit this by sending specially crafted requests to the appliance, leading to a memory overread. This can result in the disclosure of sensitive information, such as session cookies or memory-resident secrets, similar to the 'Citrix Bleed' vulnerability. Citrix has released security updates to address this issue, and CISA has confirmed active exploitation.

Affected products

  • Citrix NetScaler ADC
  • Citrix NetScaler Gateway

Timeline

  • 2025-07-10: disclosed
  • 2025-07-10: advisory
  • 2025-07-10: kev added: Added to CISA KEV catalog due to active exploitation.
  • 2025-07-10: exploited

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.