CVE-2025-5777 (Citrix Bleed 2): NetScaler memory over-read that leaks session material
The short version: CVE-2025-5777 — nicknamed "Citrix Bleed 2" — is an out-of-bounds memory-read flaw in NetScaler ADC and Gateway configured as a Gateway or AAA virtual server. An unauthenticated attacker can read chunks of appliance memory, and what leaks can include sensitive session material — the same pattern that made the original CitrixBleed a ransomware front door. NVD scores it 7.5; Citrix and the real world score it much higher. It's in CISA's KEV catalog with ransomware use. Patch and deal with any sessions that already leaked. Steady hands, but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Moderate in practice (see below) |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVSS (Citrix, CNA) | 9.3 — Critical · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L |
| EPSS | ~99.9% · 99.96th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2025-07-11 |
| Known exploited? | Yes — actively exploited, including by ransomware operators |
| Vulnerability type | CWE-125 out-of-bounds read (CWE-457 use of uninitialized memory) → sensitive memory disclosure → session hijack risk |
| Requires authenticated session? | No — pre-authentication (device must be configured as a Gateway or AAA virtual server) |
| Affected | NetScaler ADC & Gateway configured as a Gateway/AAA vServer: 14.1 < 14.1-43.56, 13.1 < 13.1-58.32, 13.1-FIPS/NDcPP < 13.1-37.235, 12.1-FIPS/NDcPP < 12.1-55.328 (12.1 and 13.0 are EOL) |
| Fixed in | 14.1-43.56 · 13.1-58.32 · 13.1-37.235 (FIPS/NDcPP) · 12.1-55.328 (FIPS/NDcPP) |
What you need to know
NetScaler ADC/Gateway sits at the network edge. CVE-2025-5777 is an out-of-bounds memory read: insufficient input validation lets an unauthenticated attacker over-read memory from an appliance configured as a Gateway or AAA virtual server, returning fragments of what the device is holding.
That echoes 2023's CitrixBleed almost exactly, and it's why the practical severity outruns the base score:
- NVD scores it 7.5 (High) because, mechanically, it's "only" confidentiality — an information leak.
- Citrix scores it 9.3 (Critical), and the ecosystem agreed: it was branded "Citrix Bleed 2," exploited quickly, and used by ransomware operators.
- What leaks is the problem. When memory fragments include session-related material, an attacker can work toward replaying a valid session — stepping past authentication rather than breaking it. Patching the read doesn't retroactively protect sessions that were already exposed.
How serious we see it
Moderate — in practice, not on paper.
The 7.5 is technically defensible and practically misleading, exactly as it was for the first CitrixBleed. When an unauthenticated memory leak on an internet-facing access gateway can surface session material, an "information disclosure" bug behaves like an authentication-bypass risk. We rate it by what it does, not by which CVSS box it lands in — and the KEV listing, ransomware use, and near-maximum EPSS all point the same way. The bounded, reassuring part: specific builds, published fixes, quick to confirm. The catch — as with the original — is that fixing the flaw doesn't undo a leak that already happened.
Recommendations
Straight from Citrix's bulletin (CTX693420) and CISA:
- Patch now. Upgrade to 14.1-43.56 / 13.1-58.32 (or the matching FIPS/NDcPP builds 13.1-37.235 / 12.1-55.328) or later. NetScaler 12.1 and 13.0 are End-of-Life — migrate off them.
- Terminate active sessions after upgrading — don't skip this. Follow Citrix's guidance to kill existing ICA/PCoIP sessions so material that leaked pre-patch can't be replayed.
- Hunt for prior use. Review authentication and session logs for anomalous or impossible-travel sessions and reused tokens from unexpected IPs.
- If you find evidence of compromise, respond. Rotate credentials and secrets, and investigate for lateral movement.
- Confirm your exposure first. Verify your build and whether it's configured as a Gateway/AAA vServer.
How BreachRisk sees it
BreachRisk starts from the outside, the way an attacker does. From little more than your domain it discovers internet-facing NetScaler Gateway interfaces, fingerprints the build, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — pushed to the top of your results because it's in KEV and because our severity take reflects the real-world impact, not just the 7.5.
The value of a continuous attacker's-eye view is precisely for flaws like this, where the CVSS band undersells the danger: you see the exposed appliance ranked by how it actually gets used against you, not by a score that stops at "information disclosure."