CVE-2025-5777

Think of the NetScaler as the “front desk” that handles incoming connections for your VPN and other services. This flaw happens when the device doesn’t properly check certain incoming messages, so it can accidentally read more information than it should from memory. That can help an attacker learn sensitive details or make further attacks easier.

This matters to you if you use or run Citrix Systems Inc. NetScaler Application Delivery Controller (NetScaler ADC) or Citrix Systems Inc. NetScaler Gateway, including the common “citrix netscaler application delivery controller” and “citrix netscaler gateway” setups. It’s specifically triggered when NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. If you do not use NetScaler Gateway/AAA features, your exposure may be lower, but you still need to confirm your configuration.

This is RED urgency because it’s known to be exploited in the wild (CISA KEV says it’s used in ransomware) and press reports indicate “itw” exploitation. The risk is especially high because the estimated chance of exploitation in the next 30 days is extremely likely, meaning attackers are actively looking for unpatched systems. Even though there is no public exploit listed, detection templates exist and threat actors can still use reliable methods.

1. Identify exposure

• Confirm the exact product and role: NetScaler Application Delivery Controller (NetScaler ADC) and/or NetScaler Gateway.
• Confirm whether any virtual servers are configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) and/or as an AAA virtual server.
• If you’re unsure, have your IT person review your NetScaler configuration.

2. Patch immediately

• Apply the Citrix hotfix or upgrade to the version(s) that fix CVE-2025-5777, as provided by Citrix for your exact NetScaler model and current version.
• Coordinate a maintenance window if required, but treat this as urgent because exploitation is already occurring.

3. Apply compensating controls if patching is delayed

• Reduce exposure: limit access to the NetScaler management and service endpoints to only the necessary IP ranges and users.
• Follow Citrix’s recommended interim mitigations for this specific issue (use the vendor guidance for your configuration), since configurations differ between ADC/Gateway and between Gateway vs AAA virtual server setups.

4. Monitor and validate

• Verify that the device is on the corrected version after the change.
• Review logs for unusual connection patterns targeting the Gateway/AAA functions mentioned above.
• Look for signs of ransomware-related activity per your incident-response playbook (especially abnormal user/session behavior and suspicious authentication events).

5. Confirm scope and repeat

• If you have multiple NetScaler devices or multiple environments, repeat the checks and patching across all of them that match the affected roles (Gateway and/or AAA).

Severity and likelihood: Rated HIGH (CVSS 7.5). EPSS is 99.9% estimated probability of exploitation in the next 30 days. CISA KEV indicates it’s known to be exploited (used in ransomware), and press reports say it’s exploited in the wild.

Weakness type and trigger: Insufficient input validation causing a memory overread. The issue is triggered when NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR an AAA virtual server.

Products/affected components: Citrix Systems Inc. NetScaler Application Delivery Controller, Citrix Systems Inc. NetScaler Gateway, including the commonly referenced forms “citrix netscaler application delivery controller” and “citrix netscaler gateway”, as well as “NetScaler ADC” and “NetScaler Gateway”.

Attack vector: Remote, via crafted input to the Gateway/AAA services exposed by NetScaler.

Exploitation tooling context: Public exploit available status is “no,” but a Nuclei detection template exists. For EPSS/KEV: EPSS is a statistical estimate of how likely exploitation is in the near term; KEV is the CISA list of vulnerabilities known to be exploited—both here point to active, real-world attacker interest.