--- title: "Citrix Bleed 2: NetScaler Gateway Memory Leak" url: https://erroneo.us/security/briefs/citrix-bleed-2-netscaler-cve-2025-5777/ description: "CVE-2025-5777 leaks NetScaler Gateway/AAA memory pre-auth; fixed in 14.1-43.56 and 13.1-58.32, exploited, KEV. Verify builds, kill sessions, hunt." type: security-brief section: "Security Digest" date_published: 2025-06-17 date_modified: 2026-10-21 publisher: erroneo.us author: erroneo.us Security Desk verdict: "Check exposure" cves: ["CVE-2025-5777", "CVE-2025-6543"] severity: "critical" exploited: "in-the-wild" kev: true license: All rights reserved. Quote with attribution and a link. --- # Citrix Bleed 2: NetScaler Gateway Memory Leak **Verdict: Check exposure.** A pre-auth memory leak on internet-facing VPN gateways that was exploited within weeks; patched since June 2025, so the job now is proving you patched, killed sessions and were not session-hijacked. - **Who must act:** Operators of customer-managed NetScaler ADC or Gateway configured as a Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server that were below the fixed builds in mid-2025. - **Who can relax:** Citrix-managed cloud services customers (updated by the vendor) and appliances not configured as a Gateway or AAA virtual server that are on current builds. - **Affected:** NetScaler ADC and Gateway 14.1 before 14.1-43.56; NetScaler ADC and Gateway 13.1 before 13.1-58.32; NetScaler ADC 13.1-FIPS/NDcPP before 13.1-37.234; NetScaler ADC 12.1-FIPS/NDcPP before 12.1-55.327 - **Fixed:** 14.1-43.56; 13.1-58.32; 13.1-FIPS/NDcPP 13.1-37.234; 12.1-FIPS/NDcPP 12.1-55.327; CVE-2025-6543: 14.1-47.46, 13.1-59.19, 13.1-FIPS/NDcPP 13.1-37.236 - **CVEs:** CVE-2025-5777, CVE-2025-6543 - **CISA KEV:** yes · **Exploitation:** Exploited in the wild ## What to do 1. Confirm every NetScaler node runs at least 14.1-47.46 or 13.1-59.19 (covers both CVE-2025-5777 and CVE-2025-6543) with show version. 2. After patching, run kill icaconnection -all and kill pcoipConnection -all on the HA primary or on every cluster node. 3. Review Gateway and AAA session logs from June-July 2025 for sessions reused from multiple IPs or from hosting-provider ranges. 4. If hijacking is suspected, reset affected users' credentials, revoke their sessions in downstream apps, and hunt for AD reconnaissance (LDAP queries, ADExplorer). 5. Move any appliance on a branch without a listed fix to a supported, patched branch. ### How to check if you are affected - Send watchTowr's detection request to POST /p/u/doAuthentication.do with a bare login parameter and check whether comes back populated (unpatched) or empty. - Look for one NetScaler session ID used from several source IPs, especially data-center or consumer-VPN addresses. - Hunt internally for LDAP enumeration and ADExplorer64.exe runs that follow Citrix logins. ## What happened On June 17, 2025, Cloud Software Group [shipped fixes](https://www.netscaler.com/blog/news/critical-security-updates-for-netscaler-netscaler-gateway-and-netscaler-console/) for CVE-2025-5777 (CVSS 4.0 9.3) in NetScaler ADC and NetScaler Gateway. The flaw is insufficient input validation that leads to a memory overread. It only affects appliances configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. Researchers nicknamed it "Citrix Bleed 2" because it resembles the 2023 Citrix Bleed bug: an unauthenticated request makes an internet-facing gateway return memory it should not. [watchTowr's analysis](https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/) found the bug in the login endpoint `/p/u/doAuthentication.do`. A `login` parameter sent with no value leaves a stack buffer uninitialized, and its contents are echoed back inside ``. Repeated requests leak different memory fragments. watchTowr could leak other users' HTTP requests but saw no session IDs in its lab tests. It warned that busy production gateways might leak more. On June 26 [ReliaQuest](https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/) reported, with medium confidence, that the bug was being exploited for initial access. It saw hijacked Citrix sessions that bypassed MFA, sessions reused across IPs, and follow-on Active Directory reconnaissance. [CISA added CVE-2025-5777 to KEV](https://www.cisa.gov/news-events/alerts/2025/07/10/cisa-adds-one-known-exploited-vulnerability-catalog) on July 10, 2025. The KEV snapshot also flags known ransomware use. A separate bug, [CVE-2025-6543](https://cveawg.mitre.org/api/cve/CVE-2025-6543) (CVSS 4.0 9.2), is a memory overflow in the same Gateway/AAA configurations that can cause denial of service and unintended control flow. Its CVE record was published on June 25 with fixed builds, and Citrix [said it had seen limited exploitation](https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/) before the patch. CISA added it to KEV on June 30. The vendor says the two bugs are unrelated. ## Who is affected According to the [CVE record](https://cveawg.mitre.org/api/cve/CVE-2025-5777) and the vendor bulletin, CVE-2025-5777 affects customer-managed NetScaler ADC and Gateway 14.1 before 14.1-43.56 and 13.1 before 13.1-58.32. It also affects the FIPS/NDcPP builds before 13.1-37.234 and 12.1-55.327. CVE-2025-6543 needs newer builds: 14.1-47.46, 13.1-59.19 and 13.1-FIPS/NDcPP 13.1-37.236. Citrix-managed cloud services were updated by the vendor. NIST's first description wrongly included the management interface. The vendor had that corrected, and the issue is limited to Gateway and AAA virtual servers. ## Do you really need to act? If you run NetScaler as a VPN or ICA gateway, this was an act-now bug in summer 2025. The vendor said there was no mitigation and that WAF signatures could not fix it. By October 2026, any appliance still unpatched is a serious hygiene failure. For everyone else the question is what happened during the exposure window. Patching closes the leak but does not invalidate a session token an attacker already stole. That is why the vendor told customers to kill sessions after upgrading. The verdict is check-exposure: confirm the build, confirm sessions were killed, and review mid-2025 logs for hijacking. ## What to do now 1. Run `show version` on every node. Being on 14.1-47.46 or 13.1-59.19 or later covers both CVEs. 2. After upgrading all HA and cluster nodes, run `kill icaconnection -all` and `kill pcoipConnection -all`. Run them on the HA primary, or on each node in a cluster. The vendor advises against rebooting instead. 3. Review Gateway and AAA logs from June-July 2025 for one session used from multiple IPs or from hosting-provider ranges. 4. If you suspect hijacking, reset the affected users' credentials and MFA, revoke their downstream sessions, and hunt for AD reconnaissance. 5. If a node runs a branch with no listed fix, move it to a supported, patched branch. ## How to tell if you were hit watchTowr published a safe check. Send a POST to `/p/u/doAuthentication.do` with a bare `login` parameter. A populated `` means the appliance is unpatched, and an empty one means it is fixed. For compromise, ReliaQuest's indicators are the most practical: session IDs reused across unrelated IPs, logins from data-center or consumer-VPN ranges, MFA prompts users never saw, and LDAP enumeration or `ADExplorer64.exe` activity after Citrix logins. ## Timeline - Jun 17, 2025 — Bulletin CTX693420 and fixed builds released for CVE-2025-5777. - Jun 25, 2025 — CVE-2025-6543 record published with fixed builds. The vendor reports limited exploitation. - Jun 26, 2025 — ReliaQuest reports likely exploitation of CVE-2025-5777. - Jun 30, 2025 — CISA adds CVE-2025-6543 to KEV. - Jul 4, 2025 — watchTowr publishes its root-cause analysis and detection check. - Jul 10, 2025 — CISA adds CVE-2025-5777 to KEV with a one-day federal deadline. ## Sources 1. [NetScaler (Cloud Software Group) — Critical security updates for NetScaler, NetScaler Gateway and NetScaler Console](https://www.netscaler.com/blog/news/critical-security-updates-for-netscaler-netscaler-gateway-and-netscaler-console/) 2. [NetScaler — Critical security updates for CVE-2025-6543 and CVE-2025-5777](https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/) 3. [CVE Program — CVE-2025-5777 record (Citrix CNA)](https://cveawg.mitre.org/api/cve/CVE-2025-5777) 4. [CVE Program — CVE-2025-6543 record (Citrix CNA)](https://cveawg.mitre.org/api/cve/CVE-2025-6543) 5. [CISA — CISA Adds One Known Exploited Vulnerability to Catalog (Jul 10, 2025)](https://www.cisa.gov/news-events/alerts/2025/07/10/cisa-adds-one-known-exploited-vulnerability-catalog) 6. [watchTowr Labs — How Much More Must We Bleed? Citrix NetScaler Memory Disclosure (CitrixBleed 2 CVE-2025-5777)](https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/) 7. [ReliaQuest — Threat Spotlight: Citrix Bleed 2 vulnerability in NetScaler ADC/Gateway devices](https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/) --- Source page: https://erroneo.us/security/briefs/citrix-bleed-2-netscaler-cve-2025-5777/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt