CVE-2025-5777: Citrix NetScaler ADC and Gateway Out-of-Bounds Read
Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability. Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.
- CISA KEV-listed (remediation due 2025-07-11)
- used in ransomware campaigns
- EPSS 99.9% (100.0% percentile)
- CVSS 9.3 critical
Related briefings
- Access broker exploits Citrix bug to plant DragonForce ransomware 2026-07-10
- New Citrix NetScaler flaw leaks memory from VPN gateways 2026-06-30
- Salt Typhoon Targets European Telecom: CVE-2025-5777 Citrix NetScaler Exploit, SNAPPYBEE/Deed RAT via Antivirus DLL Sideloading, and Dual HTTP/TCP C2 via LightNode VPS 2026-02-16