CVE-2025-5777 — Insufficient input validation leading to memory overread when the NetScaler is c

Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

01What is this vulnerability?

Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

02Affected products

No structured affected-product list available — see references below for vendor advisories.

03Active exploitation status

Yes — actively exploited. Added to the CISA KEV catalog on 2025-07-10. Ransomware use: Known.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Open the Sigma generator with a pre-filled prompt for this CVE to draft a starting detection in your stack of choice:

Open in Sigma generator →

07Related CVEs

08Timeline

• Published: 2025-06-17T13:15:21.523
• Last modified: 2026-08-04T05:16:35.613
• Added to CISA KEV: 2025-07-10

09References

• support.citrix.com — https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420
• citrixbleed.com — https://citrixbleed.com
• horizon3.ai — https://horizon3.ai/attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-wri…
• labs.watchtowr.com — https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-d…
• www.bleepingcomputer.com — https://www.bleepingcomputer.com/news/security/cisa-tags-citrix-bleed-2-as-explo…
• www.netscaler.com — https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-…
• www.theregister.com — https://www.theregister.com/2025/07/10/cisa_citrixbleed_kev/
• doublepulsar.com — https://doublepulsar.com/citrixbleed-2-exploitation-started-mid-june-how-to-spot…
• reliaquest.com — https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-net…
• www.cisa.gov — https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-…