Servers and applications

CVE-2025-5777

Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 10 Jul 2025.

Severity: Critical 9.3
Published: 17 Jun 2025
Last changed: 8 Oct 2026
Added to UpHeron: 1 Nov 2026
Fixed in: 12.1-55.328, 13.1-37.235, 13.1-58.32, 14.1-43.56
Sources: NVD

Affected software

Software	Affected versions
NetScaler ADC and GatewayServers and applications · `cpe:a:citrix:netscaler_application_delivery_controller`	From 12.1 before 12.1-55.328 From 13.1 before 13.1-37.235 From 13.1 before 13.1-58.32 From 14.1 before 14.1-43.56
NetScaler ADC and GatewayServers and applications · `cpe:a:citrix:netscaler_gateway`	From 13.1 before 13.1-58.32 From 14.1 before 14.1-43.56

Known exploited

CISA name: Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due for US agencies: 11 Jul 2025
Used in ransomware: Yes, known

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2025-5777
CVE.org https://www.cve.org/CVERecord?id=CVE-2025-5777