CVE intelligenceCISA KEVRansomware use

CVE-2025-5777

Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability

Published Jun 17, 2025Sources checked Oct 28, 2026

7.5HIGHCVSS out of 10

What this means

Actively exploited

CISA lists CVE-2025-5777 in its Known Exploited Vulnerabilities catalog, which means exploitation has been observed. The entry applies to Citrix NetScaler ADC and Gateway.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploit: Cataloged public exploit.

Exploit-DB: Citrix NetScaler ADC/Gateway 14.1 - Memory Disclosure (2026-09-23 21:40:27.335989+00)
Exploit-DB lists a public exploit or proof of concept for this CVE. SecurityAlert has not executed it; this is not evidence of attacks against your systems.

What to do next

Remediation and response

Citrix Security Bulletins guidance

Vendor revision: Jul 20, 2026

Vendor remediation details

Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible. NetScaler ADC and NetScaler Gateway 14.1-43.56 and later releases NetScaler ADC and NetScaler Gateway 13.1-58.32 and later releases of 13.1 NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.235 and later releases of 13.1-FIPS and 13.1-NDcPP NetScaler ADC 12.1-FIPS 12.1-55.328 and later releases of 12.1-FIPS Additionally, we recommend running the following commands to terminate all active ICA and PCoIP sessions after all NetScaler appliances in the HA pair or cluster have been upgraded to the fixed builds.: kill icaconnection -all kill pcoipConnection -all Please ensure that the formatting remains intact as you copy and paste these commands. Note: NetScaler ADC and NetScaler Gateway versions 12.1 and 13.0 are now End Of Life (EOL) and no longer supported. Customers are recommended to upgrade their appliances to one of the supported versions that address the vulnerabilities. Cloud Software Group has published a related blog at https://www.netscaler.com/blog/news/evaluating-netscaler-logs-for-indicators-of-attempted-exploitation-of-cve-2025-5777/ which contains further context.

Vendor-listed releases

NetScaler ADC and NetScaler Gateway 14.1-43.56 and later releases
NetScaler ADC and NetScaler Gateway 13.1-58.32 and later releases of 13.1
NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.235 and later releases of 13.1-FIPS and 13.1-NDcPP
NetScaler ADC 12.1-FIPS 12.1-55.328 and later releases of 12.1-FIPS

CISA KEVListedObserved exploitation

EPSS100.0%Estimated 30-day exploitation probability

Ransomware useReported by CISACISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2025-5777?

Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

Source: NVD

CISA says:Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.CISA catalog due date Jul 11, 2025