Search/CVE-2025-5777
● CVE — High

CVE-2025-5777

VendorcitrixProductnetscaler application delivery controller, netscaler gatewayDiscoveredJun 17, 2025UpdatedOct 7, 2026

Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

View graph Watch Export
CVSS v3.1
7.5 HIGH
EPSS
99.9%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
22
sources referencing this CVE
Related IOCs
1
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Sep 19, 2026
▲ 0.01pp
99.9% → 99.9% over 5 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityNONE
AvailabilityNONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Connections
27 relationships
Timeline
disclosure → media coverage
Jun 17, 2025
Disclosure — published as a CVE record. · last revised by NVD Oct 7, 2026
Aug 4, 2025
cybersecitalia.it reports: Attacchi cyber in Italia: +53% gli eventi nel primo semestre 2025. Tra i settori più colpiti PA, telco ed energia
Aug 4, 2025
acn.gov.it reports: OPERATIONAL SUMMARY 1° SEMESTRE 2025
Aug 12, 2025
bleepingcomputer.com reports: Over 3,000 NetScaler devices left unpatched against CitrixBleed 2 bug
Aug 12, 2025
helpnetsecurity.com reports: Netscaler vulnerability was exploited as zero-day for nearly two months (CVE-2025-6543)
Aug 14, 2025
securityweek.com reports: CISA Warns of Attacks Exploiting N-able Vulnerabilities
Aug 26, 2025
helpnetsecurity.com reports: NetScaler ADC/Gateway zero-day exploited by attackers (CVE-2025-7775)
Oct 3, 2025
securityweek.com reports: In Other News: PQC Adoption, New Android Spyware, FEMA Data Breach
Oct 6, 2025
go.theregister.com reports: Leak suggests US government is fibbing over FEMA security failings
Nov 12, 2025
bleepingcomputer.com reports: Hackers exploited Citrix, Cisco ISE flaws in zero-day attacks
Nov 12, 2025
go.theregister.com reports: Attackers turned Citrix, Cisco 0-day exploits into custom-malware hellscape
Nov 12, 2025
therecord.media reports: ‘Advanced’ hacker seen exploiting Cisco, Citrix zero-days
Nov 13, 2025
securityweek.com reports: Cisco ISE, CitrixBleed 2 Vulnerabilities Exploited as Zero-Days: Amazon
Nov 13, 2025
securityweek.com reports: Critical WatchGuard Firebox Vulnerability Exploited in Attacks
Nov 13, 2025
securityweek.com reports: CISA Updates Guidance on Patching Cisco Devices Targeted in China-Linked Attacks
Nov 14, 2025
securityweek.com reports: Fortinet Confirms Active Exploitation of Critical FortiWeb Vulnerability
Dec 18, 2025
securityweek.com reports: China-Linked Hackers Exploiting Zero-Day in Cisco Security Gear
Jan 5, 2026
securityweek.com reports: CISA KEV Catalog Expanded 20% in 2025, Topping 1,480 Entries
Jan 16, 2026
securityweek.com reports: Cisco Patches Vulnerability Exploited by Chinese Hackers
Feb 3, 2026
bleepingcomputer.com reports: Wave of Citrix NetScaler scans use thousands of residential proxies
Apr 17, 2026
bleepingcomputer.com reports: Payouts King ransomware uses QEMU VMs to bypass endpoint security
Jun 15, 2026
infosecurity-magazine.com reports: Adriatic Port Cyber-Attack by Anubis Sparks Warning Over Maritime Security Risks
Jul 2, 2026
thehackernews.com reports: Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials
Public PoC (10)
github.com/mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC-github.com/RickGeex/CVE-2025-5777-CitrixBleedgithub.com/idobarel/CVE-2025-5777github.com/nocerainfosec/cve-2025-5777github.com/RaR1991/citrix_bleed_2github.com/orange0Mint/CitrixBleed-2-CVE-2025-5777github.com/Chocapikk/CVE-2025-5777github.com/win3zz/CVE-2025-5777github.com/FrenzisRed/CVE-2025-5777github.com/bughuntar/CVE-2025-5777
Unverified third-party code — review before executing.