CVE-2025-5777

CVE Enrichment

CVSS: 9.3 CRITICAL
EPSS: 99.97%
EPSS Percentile: 99.98%
CISA KEV: YES — Known Exploited Vulnerability

Description

Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

Technical Details

CVSS Version: 4.0
CNA / NVD Source: secure@citrix.com
Published: 17-Jun-2025 20:15
Last Modified: 08-Oct-2026 17:35
EPSS Date: 2026-10-11
CWE: CWE-125, CWE-908

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:L /
                            SI:L /
                            SA:L /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

CISA KEV Details

Date Added: 2025-07-10
Remediation Due: 2025-07-11
Known Ransomware Campaign Use: Known
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420 ; https://nvd.nist.gov/vuln/detail/CVE-2025-5777

Affected Products / Versions

citrix / netscaler_application_delivery_controller
Version / affected range: * · from (inclusive) 12.1 · before (exclusive) 12.1-55.328
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*
citrix / netscaler_application_delivery_controller
Version / affected range: * · from (inclusive) 13.1 · before (exclusive) 13.1-37.235
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*
citrix / netscaler_application_delivery_controller
Version / affected range: * · from (inclusive) 13.1 · before (exclusive) 13.1-37.235
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*
citrix / netscaler_application_delivery_controller
Version / affected range: * · from (inclusive) 13.1 · before (exclusive) 13.1-58.32
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*
citrix / netscaler_application_delivery_controller
Version / affected range: * · from (inclusive) 14.1 · before (exclusive) 14.1-43.56
cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*
citrix / netscaler_gateway
Version / affected range: * · from (inclusive) 13.1 · before (exclusive) 13.1-58.32
cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*
citrix / netscaler_gateway
Version / affected range: * · from (inclusive) 14.1 · before (exclusive) 14.1-43.56
cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*

References

Last enrichment sync: 12-Oct-2026 19:30
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (4)

attractive targets. Incidents involving Multer for Node.js, Microsoft SharePoint, CVE-2025-20337, and CVE-2025-5777 reinforced that concern. Cyble Explains How Organizations Can Quantify Cyber Risk in Financial Terms
CVE-2025-5777 Exposed Directory Reveals Russian-Speaking Broker’s Intrusions and Ukraine-Focused Collection
CVE-2025-5777 (Citrix Bleed 2). Acronis Details INC Ransomware’s Growth, Tactics and Cross-Platform Payloads
The intrusion began with exploitation of CVE-2025-5777, a vulnerability affecting Citrix NetScaler Gateway appliances, in the first week of July 2025. From there, the actor pivoted to Citrix Virtual Delivery Agent (VDA) Darktrace Links Citrix Intrusion at European Telecom to Salt Typhoon

CVE (14)

Malware (15)

People (8)

Threat Actors (23)

MITRE ATT&CK (15)

Vendors (12)

Products (27)

Tools (52)

Industries (18)

Countries (11)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.