---
id: "CVE-2025-5777"
kind: "vulnerability"
aliases: ["CVE-2025-5777"]
title: "Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual\u2026"
severity: "critical"
cvss: 9.3
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Citrix NetScaler ADC and Gateway", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": ["12.1-55.328"], "affected": ">= 12.1, < 12.1-55.328", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": ["13.1-37.235"], "affected": ">= 13.1, < 13.1-37.235", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": ["13.1-58.32"], "affected": ">= 13.1, < 13.1-58.32", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": ["14.1-43.56"], "affected": ">= 14.1, < 14.1-43.56", "ecosystem": "vendor"}, {"name": "citrix netscaler gateway", "fixed": ["13.1-58.32"], "affected": ">= 13.1, < 13.1-58.32", "ecosystem": "vendor"}, {"name": "citrix netscaler gateway", "fixed": ["14.1-43.56"], "affected": ">= 14.1, < 14.1-43.56", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["citrix", "exploited", "infrastructure", "netscaler", "ransomware", "self-hosted", "vpn"]
not_affected_if: ["default-config"]
published_at: "2025-06-17T13:15:21+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-5777", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5777", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# Insufficient input validation leading to memory overread when the NetScaler is configured as a Gateway (VPN virtual…

Citrix NetScaler ADC and Gateway contain an out-of-bounds read caused by insufficient input validation, triggered when the appliance runs as a Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. An attacker can read memory beyond the intended buffer, which can leak session tokens and other sensitive data held in the appliance's memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Citrix NetScaler ADC and Gateway affected ? fixed ?
- vendor:citrix netscaler application delivery controller affected >= 12.1, < 12.1-55.328 fixed 12.1-55.328
- vendor:citrix netscaler application delivery controller affected >= 13.1, < 13.1-37.235 fixed 13.1-37.235
- vendor:citrix netscaler application delivery controller affected >= 13.1, < 13.1-58.32 fixed 13.1-58.32
- vendor:citrix netscaler application delivery controller affected >= 14.1, < 14.1-43.56 fixed 14.1-43.56
- vendor:citrix netscaler gateway affected >= 13.1, < 13.1-58.32 fixed 13.1-58.32
- vendor:citrix netscaler gateway affected >= 14.1, < 14.1-43.56 fixed 14.1-43.56

## How to check

Check whether the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server; the sources do not give a command.

## Fix

Apply the vendor mitigations or patched build from Citrix; the sources do not name the fixed version.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-5777
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-5777

## From the sources

Citrix NetScaler ADC and Gateway contain an out-of-bounds read vulnerability due to insufficient input validation. This vulnerability can lead to memory overread when the NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_