{"id":"CVE-2025-5777","aliases":["EUVD-2025-18497","GHSA-29vj-j5w5-pcph"],"status":"published","title":"NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread","description":"Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.99964,"percentile":0.99976,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-125","CWE-457","CWE-908"],"published":"2025-06-17T12:29:34Z","modified":"2026-10-08T10:35:53Z","kev":{"date_added":"2025-07-10","due_date":"2025-07-11","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2025-07-10"},{"source":"kev","since":"2025-07-10"}],"exploits":[{"source":"pocgithub","id":"mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC-","title":"mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC-","date":"2025-06-30","url":"https://github.com/mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC-"},{"source":"pocgithub","id":"RickGeex/CVE-2025-5777-CitrixBleed","title":"RickGeex/CVE-2025-5777-CitrixBleed","date":"2025-07-04","url":"https://github.com/RickGeex/CVE-2025-5777-CitrixBleed"},{"source":"pocgithub","id":"idobarel/CVE-2025-5777","title":"idobarel/CVE-2025-5777","date":"2025-07-05","url":"https://github.com/idobarel/CVE-2025-5777"},{"source":"pocgithub","id":"nocerainfosec/cve-2025-5777","title":"nocerainfosec/cve-2025-5777","date":"2025-07-05","url":"https://github.com/nocerainfosec/cve-2025-5777"},{"source":"pocgithub","id":"RaR1991/citrix_bleed_2","title":"RaR1991/citrix_bleed_2","date":"2025-07-06","url":"https://github.com/RaR1991/citrix_bleed_2"},{"source":"pocgithub","id":"orange0Mint/CitrixBleed-2-CVE-2025-5777","title":"orange0Mint/CitrixBleed-2-CVE-2025-5777","date":"2025-07-06","url":"https://github.com/orange0Mint/CitrixBleed-2-CVE-2025-5777"},{"source":"pocgithub","id":"Chocapikk/CVE-2025-5777","title":"Chocapikk/CVE-2025-5777","date":"2025-07-08","url":"https://github.com/Chocapikk/CVE-2025-5777"},{"source":"pocgithub","id":"win3zz/CVE-2025-5777","title":"win3zz/CVE-2025-5777","date":"2025-07-08","url":"https://github.com/win3zz/CVE-2025-5777"},{"source":"pocgithub","id":"FrenzisRed/CVE-2025-5777","title":"FrenzisRed/CVE-2025-5777","date":"2025-07-09","url":"https://github.com/FrenzisRed/CVE-2025-5777"},{"source":"pocgithub","id":"0xgh057r3c0n/CVE-2025-5777","title":"0xgh057r3c0n/CVE-2025-5777","date":"2025-07-10","url":"https://github.com/0xgh057r3c0n/CVE-2025-5777"},{"source":"pocgithub","id":"bughuntar/CVE-2025-5777","title":"bughuntar/CVE-2025-5777","date":"2025-07-10","url":"https://github.com/bughuntar/CVE-2025-5777"},{"source":"pocgithub","id":"SleepNotF0und/CVE-2025-5777","title":"SleepNotF0und/CVE-2025-5777","date":"2025-07-15","url":"https://github.com/SleepNotF0und/CVE-2025-5777"},{"source":"pocgithub","id":"cyberleelawat/ExploitVeer","title":"cyberleelawat/ExploitVeer","date":"2025-07-15","url":"https://github.com/cyberleelawat/ExploitVeer"},{"source":"pocgithub","id":"Shivshantp/CVE-2025-5777-TrendMicro-ApexCentral-RCE","title":"Shivshantp/CVE-2025-5777-TrendMicro-ApexCentral-RCE","date":"2025-07-23","url":"https://github.com/Shivshantp/CVE-2025-5777-TrendMicro-ApexCentral-RCE"},{"source":"pocgithub","id":"nicecopy/POC-CVE-2025-5777","title":"nicecopy/POC-CVE-2025-5777","date":"2025-07-24","url":"https://github.com/nicecopy/POC-CVE-2025-5777"},{"source":"pocgithub","id":"below0day/Honeypot-Logs-CVE-2025-5777","title":"below0day/Honeypot-Logs-CVE-2025-5777","date":"2025-07-30","url":"https://github.com/below0day/Honeypot-Logs-CVE-2025-5777"},{"source":"pocgithub","id":"soltanali0/CVE-2025-5777-Exploit","title":"soltanali0/CVE-2025-5777-Exploit","date":"2025-08-07","url":"https://github.com/soltanali0/CVE-2025-5777-Exploit"},{"source":"exploitdb","id":"EDB-52401","title":"Citrix NetScaler ADC/Gateway 14.1 - Memory Disclosure","type":"remote","platform":"multiple","date":"2025-08-11","url":"https://www.exploit-db.com/exploits/52401"},{"source":"pocgithub","id":"rootxsushant/Citrix-NetScaler-Memory-Leak-CVE-2025-5777","title":"rootxsushant/Citrix-NetScaler-Memory-Leak-CVE-2025-5777","date":"2025-08-11","url":"https://github.com/rootxsushant/Citrix-NetScaler-Memory-Leak-CVE-2025-5777"},{"source":"pocgithub","id":"Sheep-Hunter/CVE-2025-5777-POC","title":"Sheep-Hunter/CVE-2025-5777-POC","date":"2025-08-20","url":"https://github.com/Sheep-Hunter/CVE-2025-5777-POC"},{"source":"pocgithub","id":"ndr-repo/CVE-2025-5777","title":"ndr-repo/CVE-2025-5777","date":"2025-08-20","url":"https://github.com/ndr-repo/CVE-2025-5777"},{"source":"pocgithub","id":"mr-r3b00t/CVE-2025-5777","title":"mr-r3b00t/CVE-2025-5777","date":"2025-11-16","url":"https://github.com/mr-r3b00t/CVE-2025-5777"},{"source":"pocgithub","id":"rashedhasan090/CVE-2025-5777","title":"rashedhasan090/CVE-2025-5777","date":"2025-11-23","url":"https://github.com/rashedhasan090/CVE-2025-5777"},{"source":"pocgithub","id":"ashrafzaryouh/CVE-2025-5777","title":"ashrafzaryouh/CVE-2025-5777","date":"2026-03-02","url":"https://github.com/ashrafzaryouh/CVE-2025-5777"},{"source":"pocgithub","id":"sentinel-aidefense/CVE-2025-5777","title":"sentinel-aidefense/CVE-2025-5777","date":"2026-07-02","url":"https://github.com/sentinel-aidefense/CVE-2025-5777"},{"source":"pocgithub","id":"razureink/cve-2025-5777-citrixbleed2_reproduction","title":"razureink/cve-2025-5777-citrixbleed2_reproduction","date":"2026-07-23","url":"https://github.com/razureink/cve-2025-5777-citrixbleed2_reproduction"},{"source":"nuclei","id":"CVE-2025-5777","title":"Citrix NetScaler Memory Disclosure - CitrixBleed 2","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-5777.yaml"}],"exploits_more":1,"products":[{"vendor":"citrix","product":"netscaler adc and gateway"},{"vendor":"citrix","product":"netscaler_application_delivery_controller"},{"vendor":"citrix","product":"netscaler_gateway"},{"vendor":"netscaler","product":"adc"},{"vendor":"netscaler","product":"gateway"}],"references":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420","tags":["Vendor Advisory"]},{"url":"https://doublepulsar.com/citrixbleed-2-exploitation-started-mid-june-how-to-spot-it-f3106392aa71","tags":["third-party-advisory","technical-description","signature","Third Party Advisory"]},{"url":"https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/","tags":["media-coverage","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-5777","tags":["government-resource","US Government Resource"]},{"url":"https://www.bleepingcomputer.com/news/security/cisa-tags-citrix-bleed-2-as-exploited-gives-agencies-a-day-to-patch/","tags":["Press/Media Coverage","Third Party Advisory"]},{"url":"https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/","tags":["Third Party Advisory"]},{"url":"https://www.theregister.com/2025/07/10/cisa_citrixbleed_kev/","tags":["Press/Media Coverage"]},{"url":"https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/","tags":["Third Party Advisory"]},{"url":"https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/","tags":["Third Party Advisory"]},{"url":"https://citrixbleed.com","tags":["Broken Link","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5777"},{"url":"https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices"},{"url":"https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe"},{"url":"https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777"},{"url":"https://www.bleepingcomputer.com/news/security/cisa-tags-citrix-bleed-2-as-exploited-gives-agencies-a-day-to-patch"},{"url":"https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777"},{"url":"https://www.theregister.com/2025/07/10/cisa_citrixbleed_kev"},{"url":"https://github.com/advisories/GHSA-29vj-j5w5-pcph"}],"sources":{"cve":[{"id":"CVE-2025-5777","title":"NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread","description":"Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server","status":"published","published":"2025-06-17T12:29:34.506Z","modified":"2026-10-07T17:58:25.623Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"critical","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:32:30.302289Z"}],"euvd":[{"id":"EUVD-2025-18497","description":"Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server","status":"published","published":"2025-06-17T12:29:34Z","modified":"2026-10-07T17:58:25Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"critical"}],"exploited_since":"2025-07-10","updated_at":"2026-11-02T17:27:34.353796Z"}],"ghsa":[{"id":"GHSA-29vj-j5w5-pcph","title":"Insufficient input validation leading to memory overread on the NetScaler Management Interface...","description":"Insufficient input validation leading to memory overread on the NetScaler Management Interface NetScaler ADC and NetScaler Gateway","status":"published","published":"2025-06-17T15:31:08Z","modified":"2025-10-22T00:34:22Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-125","CWE-457","CWE-908"],"updated_at":"2026-11-02T15:04:09.266545Z"}],"kev":[{"id":"CVE-2025-5777","title":"Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability","description":"Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.","cwes":["CWE-125"],"kev":{"date_added":"2025-07-10","due_date":"2025-07-11","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2025-5777","description":"Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server","status":"published","published":"2025-06-17T13:15:21.523Z","modified":"2026-10-08T10:35:53.547Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-125","CWE-908"],"updated_at":"2026-11-02T14:11:13.247441Z"}]}}