CVE-2025-5777
KEV RANSOMWARECRITICAL 9.3EPSS 100.0%
Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
- CVSS v4.0
- 9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS v3.1
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS
- 99.96% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2025-07-10, used in ransomware campaigns
- Nuclei
- critical · CWE-457
- Published
- 2025-06-17
- Updated
- 2026-08-04
Proof-of-concept exploits (26)
- https://doublepulsar.com/citrixbleed-2-exploitation-started-mid-june-how-to-spot-it-f3106…
- 0xgh057r3c0n/CVE-2025-57770★ · 2025-07-10
- Chocapikk/CVE-2025-57777★ · 2025-07-08
- FrenzisRed/CVE-2025-57770★ · 2026-02-13
- RickGeex/CVE-2025-5777-CitrixBleed1★ · 2025-07-10
- Shivshantp/CVE-2025-5777-TrendMicro-ApexCentral-RCE5★ · 2025-07-23
- SleepNotF0und/CVE-2025-57770★ · 2025-07-15
- bughuntar/CVE-2025-577730★ · 2025-07-11
- cyberajju/cve-2025-57558★ · 2025-07-25
- idobarel/CVE-2025-57770★ · 2025-07-06
- mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC-17★ · 2025-06-30
- ndr-repo/CVE-2025-57773★ · 2026-04-21
- nocerainfosec/cve-2025-57773★ · 2025-07-06
- orange0Mint/CitrixBleed-2-CVE-2025-57772★ · 2025-07-06
- oways/CitrixBleed2_POC1★ · 2025-07-06
- rob0tstxt/POC-CVE-2025-57770★ · 2025-08-18
- rootxsushant/Citrix-NetScaler-Memory-Leak-CVE-2025-57770★ · 2025-08-11
- soltanali0/CVE-2025-5777-Exploit4★ · 2025-08-08
- win3zz/CVE-2025-577748★ · 2025-07-08
- maxprog-svg/CitrixBleedCVE-2026-8452-2025-57770★ · 2026-08-30
- Sheep-Hunter/CVE-2025-5777-POC
- nicecopy/POC-CVE-2025-5777
- rashedhasan090/CVE-2025-5777
- razureink/cve-2025-5777-citrixbleed2_reproduction
- MaikCyberSec/Threat-Hunting-
- cybertechajju/cve-2025-5755