Article
NetScaler exposed edge: questions to ask your team
What a NetScaler ADC or Gateway owner does first: list appliances, check for compromise before patching, and keep management services off the internet.
Read more
Exploited vulnerability
Citrix Bleed 2 (CVE-2025-5777)
CVE-2025-5777
CVE-2025-5777 is a flaw in NetScaler ADC and NetScaler Gateway where weak input checking lets the device read and return memory it should not.
- On CISA KEV
- CVE ID
- CVE-2025-5777
- CISA KEV
- Listed
- Affected product
- NetScaler ADC and NetScaler Gateway
- Exploited
- Yes
- Published
- June 2025
In short
CVE-2025-5777 is a flaw in NetScaler ADC and NetScaler Gateway where weak input checking lets the device read and return memory it should not. It is widely called Citrix Bleed 2. CISA lists it as exploited and flags known ransomware campaign use.
- CVECVE-2025-5777
- ProductCloud Software Group (NetScaler, formerly Citrix) NetScaler ADC and NetScaler Gateway
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps4actions listedUpgrade to a fixed build · Check Secure Private Access
What it allows
An outsider with no account can make the appliance return memory it should keep private. The vendor rates it 9.3 out of 10 on the CVSS v4 scale and asks customers to end active sessions after upgrading, so treat open sessions as untrusted.
Who is affected
Per the vendor, only when the appliance is set up as a Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. Affected: 14.1 before 14.1-43.56, 13.1 before 13.1-58.32, 13.1-FIPS and NDcPP before 13.1-37.235, and 12.1-FIPS before 12.1-55.328. Versions 12.1 and 13.0 are end of life and vulnerable. Secure Private Access deployments using NetScaler are also affected. The bulletin covers customer-managed products only.
The vendor published its bulletin on 17 June 2025, together with a second flaw, CVE-2025-5349. CISA added CVE-2025-5777 to its Known Exploited Vulnerabilities (KEV) catalog on 10 July 2025. The KEV entry flags known use in ransomware campaigns.
The vendor also published a guide to checking logs for signs of attempted exploitation. The sources opened here do not name which groups used the flaw.
What to do
-
Upgrade to a fixed build
The vendor names 14.1-43.56, 13.1-58.32, 13.1-FIPS and NDcPP 13.1-37.235 and 12.1-FIPS 12.1-55.328, or later. Replace end-of-life 12.1 and 13.0 appliances.
-
End active sessions after upgrading
Once every appliance in the HA pair or cluster runs a fixed build, the vendor says to run kill icaconnection -all and kill pcoipConnection -all.
-
Check Secure Private Access
The vendor says NetScaler instances behind Secure Private Access on-prem or hybrid setups must be upgraded too.
-
Review logs for attempts
Use the vendor's guide on evaluating NetScaler logs for signs of attempted exploitation.
Questions
What is Citrix Bleed 2 (CVE-2025-5777)?
Citrix Bleed 2 is the common name for CVE-2025-5777, a flaw in NetScaler ADC and NetScaler Gateway where weak input checking lets the device return memory it should keep private. An outsider with no account can trigger it.
Which NetScaler setups are affected by CVE-2025-5777?
Per the vendor, only appliances set up as a Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. Versions 12.1 and 13.0 are end of life and vulnerable.
How do I fix CVE-2025-5777?
Upgrade to 14.1-43.56, 13.1-58.32, 13.1-FIPS and NDcPP 13.1-37.235, or 12.1-FIPS 12.1-55.328, or later. Then end active sessions with kill icaconnection -all and kill pcoipConnection -all, as the vendor says.
Is CVE-2025-5777 exploited?
CISA added it to its Known Exploited Vulnerabilities catalog on 10 July 2025, and the entry flags known ransomware campaign use. The sources opened for this page do not name which groups used the flaw.
In our research
Sources
- NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2025-5349 and CVE-2025-5777 Cloud Software Group
- CVE-2025-5777 record NIST NVD
- Known Exploited Vulnerabilities catalog CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.