⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.. Due date: 2025-07-11.
CVE-2025-5777 — CitrixBleed 2: Out-of-bounds Read in ADC
Severity
9.3CRITICALNVD
VulnCheck9.2CISA9.2
EPSS
66.7%
top 1.46%
CISA KEV
KEVRansomware
Added 2025-07-10
Due 2025-07-11
Exploit
PoC available
Public exploit / PoC exists
Affected products
Timeline
PublishedJun 17
KEV addedJul 10
KEV dueJul 11
Latest updateMar 28
CISA Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Affected Packages4 packages
🔴Vulnerability Details
3GHSA▶
GHSA-29vj-j5w5-pcph: Insufficient input validation leading to memory overread on the NetScaler Management Interface NetScaler ADC and NetScaler Gateway↗2025-06-17
💥Exploits & PoCs
2Nuclei▶
Citrix NetScaler Memory Disclosure - CitrixBleed 2
🔍Detection Rules
1Suricata▶
ET WEB_SPECIFIC_APPS Citrix Netscaler ADC & Gateway Memory Leak CitrixBleed2 (CVE-2025-5777)↗2025-07-07
📋Vendor Advisories
2🕵️Threat Intelligence
26Hackernews
▶
Hackernews
▶
Hackernews
▶