CVE-2025-5777

critical

Description

Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

From the Tenable Blog

CVE-2025-5777, CVE-2025-6543: Frequently Asked Questions About CitrixBleed 2 and Citrix NetScaler Exploitation

Published: 2025-06-27

Frequently asked questions about recent Citrix NetScaler ADC and Gateway vulnerabilities that have reportedly been exploited in the wild, including CVE-2025-5777 known as CitrixBleed 2.

References

https://www.bleepingcomputer.com/news/security/cisa-tags-citrix-bleed-2-as-exploited-gives-agencies-a-day-to-patch/

https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/

https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/

https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/

https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/

https://doublepulsar.com/citrixbleed-2-exploitation-started-mid-june-how-to-spot-it-f3106392aa71

https://www.infosecurity-magazine.com/news/ransomware-q2-2026-edr-kill/

https://www.itsecurityguru.org/2026/07/09/citrixbleed-2-exploited-in-repeatable-attack-chain-culminating-in-dragonforce-ransomware-researchers-find/?utm_source=rss&utm_medium=rss&utm_campaign=citrixbleed-2-exploited-in-repeatable-attack-chain-culminating-in-dragonforce-ransomware-researchers-find

https://www.huntress.com/blog/citrixbleed-2-dragonforce-ransomware

https://thehackernews.com/2026/07/ransomware-groups-turn-to-citrix-bleed.html

https://arcticwolf.com/resources/blog/citrixbleed-2-to-cloudflared-the-tools-and-techniques-behind-anubis-ransomware-attacks/

https://thehackernews.com/2026/06/inc-ransomware-claims-830-victims-since.html

https://www.infosecurity-magazine.com/news/anubis-ransomware-adriatic-port/

https://www.securityweek.com/hackers-abuse-qemu-for-defense-evasion/

https://www.bleepingcomputer.com/news/security/payouts-king-ransomware-uses-qemu-vms-to-bypass-endpoint-security/

https://www.sophos.com/blog/qemu-abused-to-evade-detection-and-enable-ransomware-delivery

https://therecord.media/cisa-tells-federal-agencies-to-patch-citrix-netscaler-bug

https://thehackernews.com/2026/03/citrix-netscaler-under-active-recon-for.html

https://www.itsecurityguru.org/2026/03/27/critical-citrix-netscaler-flaw-draws-citrixbleed-comparisons-as-exploitation-window-narrows/?utm_source=rss&utm_medium=rss&utm_campaign=critical-citrix-netscaler-flaw-draws-citrixbleed-comparisons-as-exploitation-window-narrows

https://www.helpnetsecurity.com/2026/03/24/netscaler-adc-gateway-cve-2026-3055/

https://thehackernews.com/2026/03/citrix-urges-patching-critical.html

https://www.bleepingcomputer.com/news/security/wave-of-citrix-netscaler-scans-use-thousands-of-residential-proxies/

https://www.greynoise.io/blog/unmasking-cisas-hidden-kev-ransomware-updates

https://www.helpnetsecurity.com/2025/12/17/cisco-secure-email-cve-2025-20393/

https://securityaffairs.com/184561/hacking/amazon-alerts-advanced-threat-actor-exploits-cisco-ise-citrix-netscaler-zero-days.html

https://www.theregister.com/2025/11/12/amazon_cisco_citrix_0day_exploits/

https://www.darkreading.com/vulnerabilities-threats/citrixbleed-2-cisco-zero-day-bugs

https://www.bleepingcomputer.com/news/security/hackers-exploited-citrix-cisco-ise-flaws-in-zero-day-attacks/

https://therecord.media/advanced-hacker-exploiting-cisco-citrix-zero-days-amazon

https://thehackernews.com/2025/11/amazon-uncovers-attacks-exploited-cisco.html

https://labs.watchtowr.com/is-it-citrixbleed4-well-no-is-it-good-also-no-citrix-netscalers-memory-leak-rxss-cve-2025-12101/

https://cyberscoop.com/amazon-threat-intel-apt-group-cisco-citrix-zero-days/

https://www.databreachtoday.com/salt-typhoon-targets-european-telecom-a-29766

https://www.theregister.com/2025/08/26/citrix_patches_trio_of_netscaler/

https://www.databreachtoday.com/citrix-netscaler-devices-yet-again-under-attack-a-29301

https://www.darkreading.com/vulnerabilities-threats/citrix-zero-day-under-active-attack

https://www.bleepingcomputer.com/news/security/citrix-fixes-critical-netscaler-rce-flaw-exploited-in-zero-day-attacks/

https://thehackernews.com/2025/08/citrix-patches-three-netscaler-flaws.html

https://cyberscoop.com/citrix-netscaler-zero-day-exploited-august-2025/

https://www.bleepingcomputer.com/news/security/pennsylvania-attorney-generals-email-site-down-after-cyberattack/

https://www.helpnetsecurity.com/2025/08/12/citrix-netscaler-exploitation-zero-day-cve-2025-6543/

https://thehackernews.com/2025/08/dutch-ncsc-confirms-active-exploitation.html

https://www.bleepingcomputer.com/news/security/netherlands-citrix-netscaler-flaw-cve-2025-6543-exploited-to-breach-orgs/

https://www.bleepingcomputer.com/news/security/citrix-bleed-2-exploited-weeks-before-pocs-as-citrix-denied-attacks/

https://www.greynoise.io/blog/exploitation-citrixbleed-2-cve-2025-5777-before-public-poc

https://www.securityweek.com/citrixbleed-2-flaw-poses-unacceptable-risk-cisa/

https://www.databreachtoday.com/attackers-now-scanning-extensively-for-citrix-bleed-2-a-28959

https://cyberscoop.com/citrixbleed2-exploits-spread/

https://therecord.media/cisa-orders-agencies-patch-citrix-bleed-2

https://thehackernews.com/2025/07/cisa-adds-citrix-netscaler-cve-2025.html

https://securityaffairs.com/179813/hacking/u-s-cisa-adds-citrix-netscaler-adc-and-gateway-flaw-to-its-known-exploited-vulnerabilities-catalog.html

https://www.theregister.com/2025/07/10/cisa_citrixbleed_kev/

https://www.cisa.gov/news-events/alerts/2025/07/10/cisa-adds-one-known-exploited-vulnerability-catalog

https://arstechnica.com/security/2025/07/critical-citrixbleed-2-vulnerability-has-been-under-active-exploit-for-weeks/

https://www.securityweek.com/exploits-technical-details-released-for-citrixbleed2-vulnerability/

https://www.theregister.com/2025/07/07/citrixbleed_2_exploits/

https://www.infosecurity-magazine.com/news/citrixbleed-2-detection-analysis/

https://www.databreachtoday.com/attackers-actively-exploit-citrix-bleed-2-vulnerability-a-28907

https://www.bleepingcomputer.com/news/security/public-exploits-released-for-citrixbleed-2-netscaler-flaw-patch-now/

https://thehackernews.com/2025/07/cisa-adds-four-critical-vulnerabilities.html

https://www.securityweek.com/thousands-of-citrix-netscaler-instances-unpatched-against-exploited-vulnerabilities/

https://www.bleepingcomputer.com/news/security/over-1-200-citrix-servers-unpatched-against-critical-auth-bypass-flaw/

https://www.securityweek.com/evidence-suggests-exploitation-of-citrixbleed-2-vulnerability/

https://www.infosecurity-magazine.com/news/citrixbleed-2-vulnerability/

https://www.bleepingcomputer.com/news/security/citrix-bleed-2-flaw-now-believed-to-be-exploited-in-attacks/

https://www.theregister.com/2025/08/12/major_outage_at_pennsylvania_attorney/

https://www.bleepingcomputer.com/news/security/citrix-warns-of-login-issues-after-netscaler-auth-bypass-patch/

https://www.helpnetsecurity.com/2025/06/30/citrixbleed-2-might-be-actively-exploited-cve-2025-5777/

https://www.helpnetsecurity.com/2025/06/29/week-in-review-backdoor-found-in-soho-devices-running-linux-high-risk-winrar-rce-flaw-patched/

https://www.securityweek.com/critical-citrix-netscaler-flaw-exploited-as-zero-day/

https://securityaffairs.com/179339/hacking/citrixbleed-2-the-nightmare-that-echoes-the-citrixbleed-flaw-in-netscaler-devices.html

https://www.theregister.com/2025/06/25/citrix_netscaler_critical_bug_exploited/

https://www.bleepingcomputer.com/news/security/new-citrixbleed-2-netscaler-flaw-let-hackers-hijack-sessions/

https://www.bleepingcomputer.com/news/security/citrix-warns-of-netscaler-vulnerability-exploited-in-dos-attacks/

https://thehackernews.com/2025/06/citrix-releases-emergency-patches-for.html

https://thehackernews.com/2025/06/citrix-bleed-2-flaw-enables-token-theft.html

https://cyberscoop.com/citrix-zero-day-netscaler/

https://www.theregister.com/2025/06/24/critical_citrix_bug_citrixbleed/

https://doublepulsar.com/citrixbleed-2-electric-boogaloo-cve-2025-5777-c7f5e349d206

https://www.helpnetsecurity.com/2025/06/23/critical-citrix-netscaler-bug-fixed-upgrade-asap-cve-2025-5777/

https://www.securityweek.com/critical-vulnerability-patched-in-citrix-netscaler/

https://www.tenable.com/blog/cve-2025-7775-citrix-netscaler-adc-and-netscaler-gateway-zero-day-remote-code-execution

https://github.com/sentinel-aidefense/CVE-2025-5777

https://github.com/YAMRAJ13y/patchpilot

https://github.com/THU-HJY/CVE-Honeypot

https://github.com/zaryouhashraf/CVE-2025-5777

https://github.com/32BitZ-Studio/Total-POC-CVE

https://github.com/rashedhasan090/CVE-2025-5777

https://github.com/mr-r3b00t/CVE-2025-5777

https://github.com/B1ack4sh/Blackash-CVE-2025-20337

https://github.com/Leonideath/nuclei-cve-crit-high

https://github.com/ndr-repo/CVE-2025-5777

https://github.com/soltanali0/CVE-2025-5777-Exploit

https://github.com/below0day/Honeypot-Logs-CVE-2025-5777

https://github.com/yembors64632/cve_monitor_Public

https://github.com/B1ack4sh/Blackash-CVE-2025-5777

https://github.com/cyberleelawat/ExploitVeer

https://github.com/Jishanluhar/CVE-2025-5777

https://github.com/bughuntar/CVE-2025-5777

https://github.com/win3zz/CVE-2025-5777

https://github.com/Chocapikk/CVE-2025-5777

https://github.com/nkbeast/New-CVE-Templates

https://github.com/nocerainfosec/cve-2025-5777

https://github.com/mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC-

https://github.com/nagenar/CVE-2025-5777-Session-Hijack

https://github.com/PuddinCat/GithubRepoSpider

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-5777

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420

Details

Source: Mitre, NVD

Published: 2025-06-17

Updated: 2026-08-04

Named Vulnerability: CitrixBleed2Named Vulnerability: CitrixBleed 2Named Vulnerability: Citrix Bleed TwoNamed Vulnerability: Citrix Bleed 2Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

Severity: High

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Severity: High

CVSS v4

Base Score: 9.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Severity: Critical

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability of Concern

Detections

Analytics