Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability

cve CVE-2025-5777 2 sources, 2 claims · Watch

CISA Known Exploited Vulnerabilities writes:
Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420 ; ht… the claim

What each source says

PropertySourceSaidMeans here
Author
author
Exploit-DBYesith Alvarez
receipt
Source
Exploit-DB
Its words
Yesith Alvarez
Read by
field:author
Said since
2026-09-29 09:40 UTC
Last answered
2026-10-02 12:02 UTC
Original
open at the source
What the source handed over
{
  "aliases": "",
  "application_url": "",
  "author": "Yesith Alvarez",
  "codes": "CVE-2025-5777",
  "date_added": "2025-08-11",
  "date_published": "2025-08-11",
  "date_updated": "2025-08-11",
  "description": "Citrix NetScaler ADC/Gateway 14.1 - Memory Disclosure",
  "file": "exploits/multiple/remote/52401.py",
  "id": "52401",
  "platform": "multiple",
  "port": "",
  "screenshot_url": "",
  "source_url": "",
  "tags": "",
  "type": "remote",
  "verified": "0"
}
—
Cwes
cwes
CISA Known Exploited VulnerabilitiesCWE-125
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
CWE-125
Read by
field:cwes
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 19:00 UTC
What the source handed over
{
  "cveID": "CVE-2025-5777",
  "cwes": "CWE-125",
  "dateAdded": "2025-07-10",
  "dueDate": "2025-07-11",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Known",
  "notes": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420 ; https://nvd.nist.gov/vuln/detail/CVE-2025-5777",
  "product": "NetScaler ADC and Gateway",
  "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.",
  "vendorProject": "Citrix",
  "vulnerabilityName": "Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability"
}
—
Due date
due_date
CISA Known Exploited Vulnerabilities2025-07-11
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
2025-07-11
Read by
field:dueDate
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 19:00 UTC
What the source handed over
{
  "cveID": "CVE-2025-5777",
  "cwes": "CWE-125",
  "dateAdded": "2025-07-10",
  "dueDate": "2025-07-11",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Known",
  "notes": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420 ; https://nvd.nist.gov/vuln/detail/CVE-2025-5777",
  "product": "NetScaler ADC and Gateway",
  "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.",
  "vendorProject": "Citrix",
  "vulnerabilityName": "Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability"
}
—
Exploited
exploited
CISA Known Exploited Vulnerabilitiesyes
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
yes
Read by
const:yes
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 19:00 UTC
What the source handed over
{
  "cveID": "CVE-2025-5777",
  "cwes": "CWE-125",
  "dateAdded": "2025-07-10",
  "dueDate": "2025-07-11",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Known",
  "notes": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420 ; https://nvd.nist.gov/vuln/detail/CVE-2025-5777",
  "product": "NetScaler ADC and Gateway",
  "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.",
  "vendorProject": "Citrix",
  "vulnerabilityName": "Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability"
}
—
Forensic triage
forensic_triage
CISA Known Exploited Vulnerabilitiesfalse
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
No
Read by
field:forensicTriage
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 19:00 UTC
What the source handed over
{
  "cveID": "CVE-2025-5777",
  "cwes": "CWE-125",
  "dateAdded": "2025-07-10",
  "dueDate": "2025-07-11",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Known",
  "notes": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420 ; https://nvd.nist.gov/vuln/detail/CVE-2025-5777",
  "product": "NetScaler ADC and Gateway",
  "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.",
  "vendorProject": "Citrix",
  "vulnerabilityName": "Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability"
}
—
Known ransomware campaign use
known_ransomware_campaign_use
CISA Known Exploited VulnerabilitiesKnown
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
Known
Read by
field:knownRansomwareCampaignUse
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 19:00 UTC
What the source handed over
{
  "cveID": "CVE-2025-5777",
  "cwes": "CWE-125",
  "dateAdded": "2025-07-10",
  "dueDate": "2025-07-11",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Known",
  "notes": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420 ; https://nvd.nist.gov/vuln/detail/CVE-2025-5777",
  "product": "NetScaler ADC and Gateway",
  "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.",
  "vendorProject": "Citrix",
  "vulnerabilityName": "Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability"
}
—
Platform
platform
Exploit-DBmultiple
receipt
Source
Exploit-DB
Its words
multiple
Read by
field:platform
Said since
2026-09-29 09:40 UTC
Last answered
2026-10-02 12:02 UTC
Original
open at the source
What the source handed over
{
  "aliases": "",
  "application_url": "",
  "author": "Yesith Alvarez",
  "codes": "CVE-2025-5777",
  "date_added": "2025-08-11",
  "date_published": "2025-08-11",
  "date_updated": "2025-08-11",
  "description": "Citrix NetScaler ADC/Gateway 14.1 - Memory Disclosure",
  "file": "exploits/multiple/remote/52401.py",
  "id": "52401",
  "platform": "multiple",
  "port": "",
  "screenshot_url": "",
  "source_url": "",
  "tags": "",
  "type": "remote",
  "verified": "0"
}
—
Product
product
CISA Known Exploited VulnerabilitiesNetScaler ADC and Gateway
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
NetScaler ADC and Gateway
Read by
field:product
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 19:00 UTC
What the source handed over
{
  "cveID": "CVE-2025-5777",
  "cwes": "CWE-125",
  "dateAdded": "2025-07-10",
  "dueDate": "2025-07-11",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Known",
  "notes": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420 ; https://nvd.nist.gov/vuln/detail/CVE-2025-5777",
  "product": "NetScaler ADC and Gateway",
  "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.",
  "vendorProject": "Citrix",
  "vulnerabilityName": "Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability"
}
—
Type
type
Exploit-DBremote
receipt
Source
Exploit-DB
Its words
remote
Read by
field:type
Said since
2026-09-29 09:40 UTC
Last answered
2026-10-02 12:02 UTC
Original
open at the source
What the source handed over
{
  "aliases": "",
  "application_url": "",
  "author": "Yesith Alvarez",
  "codes": "CVE-2025-5777",
  "date_added": "2025-08-11",
  "date_published": "2025-08-11",
  "date_updated": "2025-08-11",
  "description": "Citrix NetScaler ADC/Gateway 14.1 - Memory Disclosure",
  "file": "exploits/multiple/remote/52401.py",
  "id": "52401",
  "platform": "multiple",
  "port": "",
  "screenshot_url": "",
  "source_url": "",
  "tags": "",
  "type": "remote",
  "verified": "0"
}
—
Vendor project
vendor_project
CISA Known Exploited VulnerabilitiesCitrix
receipt
Source
CISA Known Exploited Vulnerabilities
Its words
Citrix
Read by
field:vendorProject
Said since
2026-09-28 11:44 UTC
Last answered
2026-10-02 19:00 UTC
What the source handed over
{
  "cveID": "CVE-2025-5777",
  "cwes": "CWE-125",
  "dateAdded": "2025-07-10",
  "dueDate": "2025-07-11",
  "forensicTriage": "No",
  "knownRansomwareCampaignUse": "Known",
  "notes": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420 ; https://nvd.nist.gov/vuln/detail/CVE-2025-5777",
  "product": "NetScaler ADC and Gateway",
  "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
  "shortDescription": "Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.",
  "vendorProject": "Citrix",
  "vulnerabilityName": "Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability"
}
—
Verified
verified
Exploit-DBfalse
receipt
Source
Exploit-DB
Its words
0
Read by
field:verified
Said since
2026-09-29 09:40 UTC
Last answered
2026-10-02 12:02 UTC
Original
open at the source
What the source handed over
{
  "aliases": "",
  "application_url": "",
  "author": "Yesith Alvarez",
  "codes": "CVE-2025-5777",
  "date_added": "2025-08-11",
  "date_published": "2025-08-11",
  "date_updated": "2025-08-11",
  "description": "Citrix NetScaler ADC/Gateway 14.1 - Memory Disclosure",
  "file": "exploits/multiple/remote/52401.py",
  "id": "52401",
  "platform": "multiple",
  "port": "",
  "screenshot_url": "",
  "source_url": "",
  "tags": "",
  "type": "remote",
  "verified": "0"
}
—

vulnerability

Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability
zetlyn/cve-kev · 2025-07-10
cwes CWE-125 due_date 2025-07-11 exploited yes forensic_triage false known_ransomware_campaign_use Known product NetScaler ADC and Gateway vendor_project Citrix

exploit

Citrix NetScaler ADC/Gateway 14.1 - Memory Disclosure
zetlyn/cve-exploitdb · 2025-08-11
author Yesith Alvarez platform multiple type remote verified false source