CVE-2025-5777

Think of the NetScaler as the “front desk” that handles incoming connections for your VPN and other services. This flaw happens when the device doesn’t properly check certain incoming messages, so it can accidentally read more information than it should from memory. That can help an attacker learn sensitive details or make further attacks easier.

This matters to you if you use or run Citrix Systems Inc. NetScaler Application Delivery Controller (NetScaler ADC) or Citrix Systems Inc. NetScaler Gateway, including the common “citrix netscaler application delivery controller” and “citrix netscaler gateway” setups. It’s specifically triggered when NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. If you do not use NetScaler Gateway/AAA features, your exposure may be lower, but you still need to confirm your configuration.

This is RED urgency because it’s known to be exploited in the wild (CISA KEV says it’s used in ransomware) and press reports indicate “itw” exploitation. The risk is especially high because the estimated chance of exploitation in the next 30 days is extremely likely, meaning attackers are actively looking for unpatched systems. Even though there is no public exploit listed, detection templates exist and threat actors can still use reliable methods.