CVE-2025-5777
NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread
- Published
- Jun 17, 2025
- Updated
- Oct 7, 2026
- Assigning CNA
- Citrix
- Evidence observed
- Jul 10, 2025
Primary CVSS
nvd · CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XHigh · next 30 days
- Percentile
- 100.0%
- Model date
- Oct 15, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
Sources
http/cves/2025/CVE-2025-5777.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: dsl($.matchers[*].type)
- CVE-2025-5777Research
Advisory and technical analysis of CVE-2025-5777 (CitrixBleed 2), a critical memory disclosure in Citrix NetScaler ADC and Gateway, covering root cause, detection, and mitigation.
- CVE-2025-5777Exploit
Citrix NetScaler Memory Leak PoC
- CVE-2025-5777Exploit
CVE-2025-5777 Citrix NetScaler Memory Leak Exploit (CitrixBleed 2)
CitrixBleed2 poc
CitrixBleed Exploit Tool - CVE-2025-5777 & CVE-2026-8452. Unauthenticated remote memory read from Citrix NetScaler ADC & Gateway. Steal admin session tokens, extract nsroot hashes, dump secrets, and bypass MFA. Python 3 exploit with full memory parsing.
详细讲解CitrixBleed 2 — CVE-2025-5777（越界泄漏）PoC 和检测套件
- CVE-2025-5777Exploit
Exploit for CVE-2025-5777: Citrix NetScaler Memory Disclosure (CitrixBleed 2)
- cve-2025-5777Exploit
Memory disclosure vulnerability in Citrix NetScaler ADC and Gateway when configured as a Gateway (VPN virtual server, ICA proxy, CVPN, RDP Proxy).
- CVE-2025-5777Exploit
Python exploit for CVE-2025-5777 (CitrixBleed 2) memory leak in Citrix NetScaler. Sends malformed POST requests to leak ~127 bytes of RAM per request, extracting session tokens, credentials, and other sensitive data from uninitialized memory.
Reproduction toolkit for CVE-2025-5777 (CitrixBleed 2) memory disclosure vulnerability in Citrix NetScaler ADC/Gateway. Includes PoC, affected version details, and session hijacking methodology.
CitrixBleed-2 (CVE-2025-5777) – proof-of-concept exploit for NetScaler ADC/Gateway “memory bleed”
Update the old POC of CVE-2025-5777 Citrix NetScaler Memory leak
- CVE-2025-5777Research
CVE-2025-5777 Research writeup
PoC for CVE-2025-5777 – Auth Bypass and RCE in Trend Micro Apex Central
- CVE-2025-5777Exploit
CVE-2025-5777 (CitrixBleed 2) - Critical memory leak vulnerability affecting Citrix NetScaler ADC and Gateway devices
- ExploitVeerExploit
An advanced, powerful, and easy-to-use tool designed to detect and exploit CVE-2025-5777 (CitrixBleed 2). This script not only identifies the vulnerability but also helps in demonstrating its impact by parsing human-readable information from the memory leak.
- cve-2025-5755Exploit
Asynchronous scanner and exploit tool for CVE-2025-5777 (CitrixBleed 2). Detects memory leaks in NetScaler ADC/Gateway, parses sensitive data like session cookies, and generates reports for authorized security testing.
- CVE-2025-5777Exploit
CitrixBleed2 powershell version
- CVE-2025-5777Exploit
placeholder for CitrixBleed 2.0 CVE-2025-5777
Proof-of-concept exploit for CVE-2025-5777, demonstrating the vulnerability and providing exploitation code for security testing and research.
- CitrixBleed-2-CVE-2025-5777Exploit
CitrixBleed-2 Checker & Poc automatic exploit and check token.
- citrix_bleed_2Scanner
Citrix Bleed 2 PoC Scanner (CVE-2025-5777)
Proof-of-concept exploit for CVE-2025-5777, demonstrating exploitation and enabling vulnerability verification in security assessments.
- CVE-2025-5777Exploit
CVE-2025-5777 (CitrixBleed 2) - [Citrix NetScaler ADC] [Citrix Gateway]
- CVE-2025-5777-ExploitExploit
Async-based exploit tool for CVE-2025-5777 that detects and extracts leaked authentication tokens, internal IPs, and hidden endpoint paths from vulnerable Citrix NetScaler VPN endpoints.
Yesith Alvarez · multiple · Aug 11, 2025
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.