CISA Adds Citrix NetScaler CVE-2025-5777 to KEV Catalog as Active Exploits Target Enterprises

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting Citrix NetScaler ADC and Gateway to its Known Exploited Vulnerabilities (KEV) catalog, officially confirming the vulnerability has been weaponized in the wild.

The shortcoming in question is CVE-2025-5777 (CVSS score: 9.3), an instance of insufficient input validation that could be exploited by an attacker to bypass authentication when the appliance is configured as a Gateway or AAA virtual server. It's also called Citrix Bleed 2 owing to its similarities with Citrix Bleed (CVE-2023-4966).

"Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation," the agency said. "This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server."

CISA pointed out that flaws like CVE-2025-5777 are frequent attack vectors for malicious cyber actors and pose significant risk to federal enterprises. To that end, Federal Civilian Executive Branch (FCEB) agencies are required to implement mitigations by the end of today, July 11.

Although multiple security vendors have since reported that the flaw has been exploited in real-world attacks, Citrix has yet to update its own advisories to reflect this aspect. As of June 26, 2025, Anil Shetty, senior vice president of engineering at NetScaler, said, "there is no evidence to suggest exploitation of CVE-2025-5777."

Security researcher Kevin Beaumont, in a report published this week, said the Citrix Bleed 2 exploitation started as far back as mid-June, adding one of the IP addresses carrying out the attacks has been previously linked to RansomHub ransomware activity.

Data from GreyNoise shows that exploitation efforts are originating from 10 unique malicious IP addresses located in Bulgaria, the United States, China, Egypt, and Finland over the past 30 days. The primary targets of these efforts are the United States, France, Germany, India, and Italy.

The addition of CVE-2025-5777 to the KEV catalog comes as another flaw in the same product (CVE-2025-6543, CVSS score: 9.2) has also come under active exploitation in the wild. CISA added the flaw to the KEV catalog on June 30, 2025.

"The term 'Citrix Bleed' is used because the memory leak can be triggered repeatedly by sending the same payload, with each attempt leaking a new chunk of stack memory — effectively 'bleeding' sensitive information," Akamai said, warning of a "drastic increase of vulnerability scanner traffic" after exploit details became public.

"This flaw can have dire consequences, considering that the affected devices can be configured as VPNs, proxies, or AAA virtual servers. Session tokens and other sensitive data can be exposed — potentially enabling unauthorized access to internal applications, VPNs, data center networks, and internal networks."

Because these appliances often serve as centralized entry points into enterprise networks, attackers can pivot from stolen sessions to access single sign-on portals, cloud dashboards, or privileged admin interfaces. This type of lateral movement – where a foothold quickly becomes full network access – is especially dangerous in hybrid IT environments with weak internal segmentation.

To mitigate this flaw, organizations should immediately upgrade to the patched builds listed in Citrix’s June 17 advisory, including version 14.1-43.56 and later. After patching, all active sessions, especially those authenticated via AAA or Gateway, should be forcibly terminated to invalidate any stolen tokens.

Admins are also encouraged to inspect logs (e.g., ns.log) for suspicious requests to authentication endpoints such as "/p/u/doAuthentication.do," and review responses for unexpected XML data like <InitialValue> fields. Since the vulnerability is a memory overread, it does not leave traditional malware traces, making token hijack and session replay the most urgent concerns.

The development also follows reports of active exploitation of a critical security vulnerability in OSGeo GeoServer GeoTools (CVE-2024-36401, CVSS score: 9.8) to deploy NetCat and the XMRig cryptocurrency miner in attacks targeting South Korea by means of PowerShell and shell scripts. CISA added the flaw to the KEV catalog in July 2024.

"Threat actors are targeting environments with vulnerable GeoServer installations, including those of Windows and Linux, and have installed NetCat and XMRig coin miner," AhnLab said.

"When a coin miner is installed, it uses the system’s resources to mine the threat actor’s Monero coins. The threat actor can then use the installed NetCat to perform various malicious behaviors, such as installing other malware or stealing information from the system."

Update

Citrix, in an update on July 11, once urged customers to install the necessary updates as soon as possible, and noted it was not aware of any in-the-wild exploitation of CVE-2025-5777 when it publicly disclosed the flaw.

"At the time we announced CVE-2025-5777, there was no evidence to suggest exploitation of CVE-2025-5777," Shetty said. "Subsequently, on July 11, 2025, CISA added CVE-2025-5777 to its Known Exploited Vulnerabilities catalog."

Commenting on the shortest patching deadline ever issued by the agency, Acting Executive Assistant Director for Cybersecurity, Chris Butera, shared the below statement with The Hacker News -

This vulnerability in Citrix NetScaler ADC and Gateway systems, also referred to as Citrix Bleed 2, poses a significant, unacceptable risk to the security of the federal civilian enterprise. As America's cyber defense agency and the operational lead for federal civilian cybersecurity, CISA is taking urgent action by directing agencies to patch within 24 hours and we encourage all organizations to patch right away.

Threat intelligence firm GreyNoise said active exploitation attempts against CVE-2025-5777 began on June 23, 2025, nearly two weeks before the release of a public proof-of-concept (PoC). As of July 18, eight malicious IP addresses from Bulgaria, Germany, Russia, China, and Egypt have been linked to the efforts over the past 24 hours.

In a post published this week, Security researcher Kevin Beaumont said that exploitation activity has been underway since June 20, with 128 active victims reported across tech, legal, education, legal, financial services, government, and the telecoms sectors. This includes a suspected threat cluster originating from China and a Russian ransomware group.

Imperva, which has also been tracking CVE-2025-5777, said it observed over 11.5 million attack attempts targeting thousands of sites, with 39.1% of the attacks targeting the financial services industry.

"Many of these attacks are opportunistic, leveraging automated tools to indiscriminately scan large sections of the internet," security researchers Gabriella Sharadin and Avidan Reich said.

(The story was updated after publication on July 18, 2025, to reflect the latest developments.)

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.