NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread

cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

1. 2025-06-17 Published
2. 2025-07-10 Added to CISA KEV
3. 2025-07-11 CISA patch deadline
4. 2025-08-11 First public exploit (EDB-52401)
5. 2026-08-04 CISA SSVC: exploitation active

Added

16 mo ago (2025-07-10)

Patch by

2025-07-11 (15 mo ago)

Ransomware

Known to be used in ransomware campaigns

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vendor, product

Citrix, NetScaler ADC and Gateway

CISA name

Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability

Groups reported to have exploited it in intrusions.

• DragonForce ransomware gang

reported by huntress.com

Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0

How it is exploited and what it leads to, in MITRE ATT&CK terms.

• T1190 Exploit Public-Facing Application exploitation
• T1555 Credentials from Password Stores primary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

Exploitation

Active, exploited in the wild

Automatable

yes

Technical impact

total

Assessed

3 mo ago (2026-08-04)

99.97% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

• EDB-52401 Citrix NetScaler ADC/Gateway 14.1 - Memory Disclosure remote, 2025-08-11
• Nuclei template Citrix NetScaler Memory Disclosure - CitrixBleed 2 nuclei detection template

• NetScaler ADC
• NetScaler Gateway

Weakness

• CWE-125 Out-of-bounds Read
• CWE-908 Use of Uninitialized Resource

Technology feeds

• Citrix rss critical rss

• support.citrix.com /support-home/kbsearch/article?articleNumber=CTX693420

  vendor-advisory

• doublepulsar.com /citrixbleed-2-exploitation-started-mid-june-how-to-spot-it-f3106392aa71

  third-party-advisory, technical-description, signature

• reliaquest.com /blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/

  media-coverage, third-party-advisory

• cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-5777

  government-resource, us-government-resource

• bleepingcomputer.com /news/security/cisa-tags-citrix-bleed-2-as-exploited-gives-agencies-a-day-to-patch/

  press/media-coverage, third-party-advisory

• labs.watchtowr.com /how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/

  third-party-advisory

• theregister.com /2025/07/10/cisa_citrixbleed_kev/

  press/media-coverage

• horizon3.ai /attack-research/attack-blogs/cve-2025-5777-citrixbleed-2-write-up-maybe/

  third-party-advisory

• netscaler.com /blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/

  third-party-advisory

• citrixbleed.com

  broken-link, third-party-advisory

• CVE List CVE-2025-5777
• NVD CVE-2025-5777

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.