Is CVE-2025-5777 actively exploited?

Yes. CVE-2025-5777 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2025-5777 be exploited remotely?

The attack vector of CVE-2025-5777 has not been classified yet.

What is the CVSS score of CVE-2025-5777?

CVE-2025-5777 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2025-5777

HIGHCISA KEVIN THE WILD

CVE-2025-5777

Published: July 10, 2025

EPSS:73.76%probability of exploitation in 30 daysPercentile:98.8th

Official Description

Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.

NVD Source

CISA KEV Advisory

Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability

Added to KEV: 2025-07-10Federal patch deadline: 2025-07-11⚠ USED IN RANSOMWARE CAMPAIGNS

Required Action (CISA)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Risk Analysis

Citrix NetScaler ADC and Gateway devices are susceptible to an out-of-bounds read vulnerability due to insufficient input validation, potentially leading to memory overread. This is particularly concerning when configured as a Gateway or AAA virtual server. With an EPSS score of 0.73755 and confirmed exploitation by CISA (is_in_kev: true), this is a high-priority vulnerability.

This vulnerability is actively exploited in the wild, indicating a severe and immediate risk. Its inclusion in CISA's KEV confirms its active use by attackers.

Recommended Action

Update Citrix NetScaler ADC and Gateway to the latest patched versions. If using these devices as a Gateway or AAA virtual server, prioritize applying the security updates.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2025-5777 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2025-5777 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.

Exploit & PoC Resources

ACTIVE EXPLOITATIONConfirmed exploitation in the wild

Exploit-DB

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

PacketStorm

Security advisories & exploits

External links open in a new tab. Always verify in a controlled environment before use.

News & Research Mentioning CVE-2025-5777

Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials

The Hacker News· Jul 2, 2026

Threat actors associated with the Anubis ransomware operation have been observed exploiting the Citrix Bleed 2 (CVE-2025-5777) vulnerability to obtain initial access. "Although tactics differ between affiliates, common patterns emerged in tradecraft through use of legitimate Remote Management and Monitoring (RMM) tooling, credential access, and hands-on-keyboard procedures used for lateral [xlite_meta score:62 src:The Hacker News xlite_fp:f54d1ff584f5031041f5150f9b5f6220b92cd129a06ec74cc00e1c4951f552d9]