Frequently asked questions about recent Citrix NetScaler ADC and Gateway vulnerabilities that have reportedly been exploited in the wild, including CVE-2025-5777 known as CitrixBleed 2.

CVE-2025-5777, CVE-2025-6543: Frequently Asked Questions About CitrixBleed 2 and Citrix NetScaler Exploitation

Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

Recent reports indicate that attackers are still exploiting CitrixBleed 2 in the wild. We strongly urge organizations to patch this flaw as soon as possible.

Public PoC exploits for CitrixBleed 2 are available. Patching strongly advised as well as reviewing IOCs for potential compromise.

Exploitation has been reported for this flaw and immediate patching is recommended as Citrix devices have been highly targeted in the past.

While no exploitation has been observed yet, immediate patching is recommended as Citrix devices have been targeted in the past.

Citrix NetScaler Gateway / ADC versions 14.1.x < 14.1-43.56, 13.1.x < 13.1-58.32, 13.1.x-FIPS < 13.1-37.235-FIPS and NDcPP, 12.1.x-FIPS < 12.1-55.328-FIPS, 12.1.x and 13.0.x are affected by a memory disclosure vulnerability. This issue could allow a remote and unauthenticated attacker to access sensitive information without authorization.

The remote NetScaler ADC (formerly Citrix ADC) or NetScaler Gateway (formerly Citrix Gateway) device is version 12.1 before 12.1-55.328 (12.1-FIPS) or 13.1 before 13.1-37.235 (13.1-FIPS) or 13.1 before 13.1-58.32 or 14.1 before  14.1-43.56. It is, therefore, affected by multiple vulnerabilities: 

  - Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway     (CVE-2025-5349)   
  - Insufficient input validation leading to memory overread on the NetScaler Management Interface NetScaler     ADC and NetScaler Gateway (CVE-2025-5777) 

Please refer to advisory CTX693420 for more information.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
114907	Citrix NetScaler Gateway / ADC Memory Disclosure	Web App Scanning	Component Vulnerability	Check Based	critical
240341	NetScaler ADC and NetScaler Gateway Multiple Vulnerabilities (CTX693420)	Nessus	CGI abuses	Combined	critical

Detections

Analytics

CVE-2025-5777

critical

Tenable Plugins

critical

critical