CVE-2025-5777

Citrix · Published June 17, 2025

7.5

CVSS v3.1

HIGH

CISA KEV — Federal agencies must patch by deadline

Actively exploited in the wild

Patch availableGet patch

Description

Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

Affected Products

Netscaler Application Delivery Controller < 12.1-55.328
Netscaler Application Delivery Controller < 13.1-37.235
Netscaler Application Delivery Controller < 13.1-58.32
Netscaler Application Delivery Controller < 14.1-43.56

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N