CVE-2025-5777

What it actually does

CVE-2025-5777 is an insufficient input validation flaw in Citrix NetScaler ADC/Gateway when configured as a Gateway service, including VPN virtual server, ICA Proxy, CVPN, RDP Proxy, or as an AAA virtual server. A crafted unauthenticated request can trigger an out-of-bounds memory read, causing the appliance to return data from process memory that should not be exposed. Depending on what is resident in memory at the time, leaked data may include session identifiers, authentication tokens, cookies, credentials, or other sensitive gateway state. This is an information disclosure vulnerability, but its practical impact can become account/session compromise and unauthorized remote access if valid secrets are recovered and replayed.

Why it matters to the business

This vulnerability affects internet-facing remote access infrastructure, so successful exploitation can give attackers a way to steal active access material without first compromising an endpoint. Because it is in CISA KEV, has a very high EPSS score, is reported as actively exploited in the wild, and is associated with ransomware activity, exposed appliances should be treated as high-priority incident-response candidates, not only patching tasks. Operational consequences may include unauthorized VPN or application access, theft of user sessions, bypass of normal authentication workflows through session replay, lateral movement into internal networks, service disruption during containment, regulatory exposure from leaked authentication data, and ransomware deployment. The CISA KEV remediation due date was 2025-07-11, so any still-exposed vulnerable deployment is materially overdue.

How an attack unfolds

An attacker first identifies an internet-accessible NetScaler ADC/Gateway appliance exposing Gateway or AAA functionality. They then send specially crafted requests to the affected service that are accepted despite malformed or unexpected input. The vulnerable component reads beyond the intended memory boundary and returns memory contents in the HTTP response or related protocol output. The attacker repeatedly triggers the leak and parses returned data for high-value secrets such as session cookies, authentication tokens, credentials, or gateway session artifacts. If usable session material is recovered, the attacker replays it to impersonate a legitimate user, potentially gaining VPN, ICA Proxy, CVPN, RDP Proxy, or AAA-authenticated access without knowing the user’s password. From there, activity typically shifts from exploitation of the appliance to post-authentication intrusion: enumerating reachable internal systems, harvesting additional credentials, moving laterally, establishing persistence, exfiltrating data, or staging ransomware. Public reporting associates exploitation with CitrixBleed 2 activity and ransomware operations including Anubis, so defenders should assume both opportunistic scanning and hands-on-keyboard follow-on activity are plausible.

How to fix it

Upgrade all affected NetScaler ADC and NetScaler Gateway appliances to a vendor-fixed build that addresses CVE-2025-5777. Because no fixed versions were provided in the input, use the current Citrix security bulletin for the exact fixed release applicable to each deployed branch, including any FIPS, NDcPP, or cloud-managed variants. Prioritize internet-facing Gateway and AAA virtual servers first. If immediate upgrade is not possible, restrict external access to Gateway and AAA services to trusted networks where operationally feasible, place emergency access controls in front of the service, disable unused Gateway/AAA features, and increase monitoring; these are temporary risk reductions and should not be treated as a substitute for patching. After patching, terminate all active Gateway/AAA sessions, clear or invalidate persistent sessions where supported, rotate potentially exposed credentials and secrets, and require users to reauthenticate. For systems suspected of exploitation, rebuild or replace the appliance from trusted media/configuration backup if integrity cannot be established.

How to confirm the fix worked

Confirm remediation by inventorying all NetScaler ADC/Gateway appliances and verifying the running software build against the Citrix fixed-version matrix for CVE-2025-5777. Validate that each appliance exposing VPN virtual server, ICA Proxy, CVPN, RDP Proxy, or AAA virtual server functionality is on a fixed build. Confirm that all active sessions were forcibly terminated after upgrade and that users were required to reauthenticate. From the external network perspective, verify that only intended Gateway/AAA endpoints are reachable and that emergency access restrictions are in place where required. Review appliance configuration to ensure unused Gateway/AAA virtual servers are disabled. Where an authenticated administrative interface is available, export version/build evidence and retain it with change records. If vulnerability scanners are used, ensure the plugin checks software build and Gateway/AAA configuration rather than relying only on banner detection.

Typical attack path

1. Scan the internet for NetScaler ADC/Gateway systems exposing Gateway or AAA virtual server functionality.
2. Fingerprint the appliance and determine whether it appears to be running a vulnerable build or configuration.
3. Send crafted requests that trigger the insufficient input validation and memory overread condition.
4. Collect leaked memory returned by the appliance and search it for cookies, session IDs, authentication tokens, credentials, or other reusable secrets.
5. Replay recovered session material against the Gateway or AAA service to impersonate an authenticated user.
6. Use the authenticated remote access path to reach internal applications, desktops, or management services.
7. Perform internal reconnaissance, credential collection, privilege escalation, and lateral movement.
8. Exfiltrate data, establish persistence, or deploy ransomware depending on the attacker’s objective.

How to detect it

To determine whether exploitation already occurred, review both appliance-side and enterprise authentication telemetry across the full exposure window, starting no later than the publication date of 2025-06-17 and continuing until after patching and session invalidation. On NetScaler, examine HTTP access/error logs, Gateway/VPN logs, AAA authentication logs, syslog exports, and nslog/newnslog data for bursts of malformed or unusual unauthenticated requests to Gateway or AAA virtual servers, especially followed by successful authenticated sessions from unfamiliar IP addresses. Look for repeated requests with abnormal lengths, missing or malformed parameters, unusual user agents, unexpected HTTP status patterns, or high-volume probing against VPN, ICA Proxy, CVPN, RDP Proxy, or AAA paths. Correlate suspicious request timing with successful logins, session establishment, or application launches that do not match normal user behavior. In identity-provider, MFA, and directory logs, look for valid sessions without expected MFA prompts, session reuse from new geographies or autonomous systems, impossible travel, and logins from hosting providers, anonymization services, or IPs not previously associated with the user. In endpoint and network telemetry, hunt for post-access behavior: internal scanning, SMB/RDP/WinRM/SSH connections from VPN address pools, credential dumping alerts, unusual file staging, data exfiltration, and ransomware precursor activity. Because this is a memory disclosure flaw, direct exploit artifacts may be limited; the strongest evidence is often a sequence of suspicious Gateway/AAA requests followed by anomalous but technically valid authenticated access.

• CVE-2025-5777
• CitrixBleed 2
• /var/log/ns.log
• /var/log/httpaccess.log
• /var/log/httperror.log
• /var/nslog/newnslog
• nsaaad
• VPN virtual server
• ICA Proxy
• CVPN
• RDP Proxy
• AAA virtual server

What your security team should do

• Treat all internet-facing vulnerable NetScaler Gateway or AAA deployments as potential compromise candidates because the vulnerability is KEV-listed, actively exploited, and associated with ransomware activity.
• Patch or upgrade to a Citrix-fixed build immediately, prioritizing externally reachable Gateway and AAA virtual servers.
• After remediation, forcibly terminate all active sessions and invalidate persistent Gateway/AAA session material to prevent replay of previously leaked tokens.
• Rotate credentials and secrets for privileged users, remote-access users, service accounts, and any accounts observed authenticating through the affected appliance during the exposure window.
• Hunt for exploitation and post-exploitation activity from the publication date forward, with emphasis on anomalous Gateway logins, impossible travel, unusual user agents, session reuse from new IP addresses, and access from hosting/VPN infrastructure.
• Review NetScaler appliance logs, authentication logs, identity-provider logs, VPN access logs, EDR telemetry, and internal network logs for signs of unauthorized access after suspicious Gateway activity.
• If exploitation is suspected, preserve appliance logs and forensic artifacts before rebooting or rebuilding, then engage incident response procedures.
• Add detections for abnormal requests to Gateway/AAA endpoints, repeated unauthenticated errors, unusually large or malformed requests, and authentication/session anomalies following such requests.
• Block or challenge access from known malicious infrastructure where available, but do not rely on IP blocking as the primary control because exploitation is widely opportunistic.
• Report status against the CISA KEV deadline of 2025-07-11 where applicable and document compensating controls for any delayed remediation.