Sessionwright

Known exploitedCitrixBleed 2

CVE-2025-5777: what NetScaler® admins need to do

CVE-2025-5777 (out-of-bounds read) affects NetScaler ADC and Gateway. In CISA KEV since 2025-07-10. Fixed in 14.1-43.56 / 13.1-58.32. Check your build free.Added to CISA KEV . Last verified against CISA KEV and CVE.org.

Check your build for CVE-2025-5777Request an emergency upgrade

The short answer

Affected
NetScaler ADC and NetScaler Gateway builds below the first fixed build for their release, when the precondition below is met.
Fixed in
14.1-43.56 / 13.1-58.32First fixed builds for 14.1 / 13.1. All releases in the table below.
Current safe build
14.1-73.46 / 13.1-64.29Includes later fixes. Advisory data as of 2026-10-15.
CISA KEV
Added 2025-07-10, federal due date 2025-07-11. Known ransomware use: Known.
Forensic triage
No forensic triage flag on this KEV entry.
CVSS
9.3 (CVSS v4.0, vendor score in CTX693420)
Preconditions
Configured as Gateway (VPN vserver, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server
Session kill advised
Yes, per CTX693420, after every node is upgraded.

Fixed builds from the Citrix® security bulletin CTX693420

ReleaseFirst fixed buildCurrent safe build
NetScaler 14.114.1-43.5614.1-73.46
NetScaler 13.1Past end of maintenance13.1-58.3213.1-64.29
NetScaler 13.1 FIPS/NDcPPPast end of maintenance13.1-37.235 FIPS13.1-37.283 FIPS
NetScaler 12.1 FIPS/NDcPP12.1-55.328 FIPS12.1-55.328 FIPS

FIPS and NDcPP builds have separate fixed builds: see the table and the bulletin.

What it is

“Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability”
Vulnerability name in the CISA Known Exploited Vulnerabilities catalog (catalog version 2026.10.15, product: NetScaler ADC and Gateway).

Our advisory data, taken from CTX693420, summarises it as: Memory overread. Vulnerability class: out-of-bounds read (CWE-125). Precondition: Configured as Gateway (VPN vserver, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

For the full description, read the CVE.org record for CVE-2025-5777 and the vendor bulletin.

Am I affected?

Two things must both be true: the appliance runs a build below the fixed build for its release (see the table above), and its configuration meets the precondition: Configured as Gateway (VPN vserver, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Find the build with show ns version on the CLI.

Enter your build to check it against CVE-2025-5777 and every other NetScaler CVE in our data. The checker runs in your browser and never connects to any appliance.

Opens the free checker. It runs in your browser and never connects to any appliance.

Open the checker with CVE-2025-5777 highlighted

How to patch

  1. Choose the target build: at least 14.1-43.56 on 14.1 or 13.1-58.32 on 13.1. Prefer the current safe build (14.1-73.46 / 13.1-64.29), which also includes later fixes. FIPS and NDcPP appliances need their own fixed build from the table above.
  2. Upgrade every node. In an HA pair, upgrade the secondary first, fail over, then upgrade the former primary. Our HA pair upgrade runbook walks through each step and the rollback.
  3. Confirm the build on each node with show ns version, then work through the post-patch steps below.

13.1 is past end of maintenance, so plan the move to 14.1 while you are in the change window. Check the release dates in our NetScaler end-of-life guide.

Request an emergency upgradeSee how Nightpatch runs approval-gated upgrades

After patching

Steps in the vendor bulletin

vendor bulletin
kill icaconnection -all
kill pcoipConnection -all

Run session kills only after every HA or cluster node is on the fixed build.

Additional steps from CISA, CERTs and researchers

community guidance
kill aaa session -all
kill rdp connection -all
clear lb persistentSessions
  • kill aaa session -all: Kevin Beaumont, Arctic Wolf

Run session kills only after every HA or cluster node is on the fixed build.

Hunt for compromise

Upgrading does not remove an existing compromise. These indicators and tools are published guidance; we do not run them for you.

  • CitrixBleed 2 exploitation traces

    • POST /p/u/doAuthentication.do with a 'login' parameter missing '=' (watchTowr)
    • Non-printable characters in ns.log at debug level (Horizon3)
    • Sessions used from multiple IPs; new admin accounts
    • Diff of 'show ns runningConfig -withDefaults' against a known-good baseline

    Tools: watchTowr write-up, Horizon3 write-up

    Source: watchTowr; Horizon3; ReliaQuest

Work through the NetScaler post-patch checklist: session kills, IoC checks and evidence

Timeline

  1. Vendor bulletin CTX693420 published with fixed builds
  2. Added to the CISA Known Exploited Vulnerabilities catalog
  3. CISA federal remediation due date

Related CVEs

  • CVE-2025-5349Improper access control on the management interfaceNot in KEVSame bulletin (CTX693420)
Every exploited NetScaler CVE, newest first

Sources

Last verified 2026-10-15 against CISA KEV and CVE.org. Advisory data version 2026.10.15-1.

CVE-2025-5777: questions

Which NetScaler builds fix CVE-2025-5777?

Vendor bulletin CTX693420 fixes CVE-2025-5777 in 14.1-43.56 (NetScaler 14.1), 13.1-58.32 (NetScaler 13.1), 13.1-37.235 FIPS (NetScaler 13.1 FIPS/NDcPP) and 12.1-55.328 FIPS (NetScaler 12.1 FIPS/NDcPP). As of 2026-10-15, the current safe builds, which also include later fixes, are 14.1-73.46, 13.1-64.29 and 13.1-37.283 FIPS. FIPS and NDcPP builds have separate fixed builds.

Is CVE-2025-5777 exploited in the wild?

Yes. CISA added CVE-2025-5777 to the Known Exploited Vulnerabilities catalog on 2025-07-10, with a federal remediation due date of 2025-07-11. Known ransomware campaign use: Known.

Do I need to kill sessions after patching CVE-2025-5777?

Yes. CTX693420 lists kill icaconnection -all and kill pcoipConnection -all. Run them only after every node in the HA pair or cluster is on the fixed build. Community guidance adds kill aaa session -all, kill rdp connection -all and clear lb persistentSessions.

Check every appliance, not just one, for CVE-2025-5777

The free checker answers for one build in your browser. A read-only assessment covers your whole NetScaler estate and the Citrix environment behind it.

Check your NetScaler buildBook an assessment