Citrix Bleed 2: patch NetScaler CVE-2025-5777 and end the sessions
Citrix published CVE-2025-5777 on 17 June 2025 for NetScaler ADC and Gateway. It is the memory-read bug people called Citrix Bleed 2. CISA confirmed active use in July.
Citrix advisory CTX693420 covers CVE-2025-5777, insufficient input validation in NetScaler ADC and NetScaler Gateway. An unauthenticated attacker can read memory when the appliance is a Gateway — VPN, ICA proxy, CVPN or RDP proxy — or an AAA virtual server. The score reported with the advisory is 9.3.
The nickname Citrix Bleed 2 points at the family of CVE-2023-4966, not at a second copy of the same patch. CISA added CVE-2025-5777 to the exploited catalog on 10 July 2025 after exploitation was observed from late June. Citrix said it had no evidence of use on the day it disclosed the bug.
What memory disclosure means on a gateway
The appliance terminates remote access. Memory on that box can contain session material for people who are logged in. A read bug there is a path to someone else's session, which is why the 2023 namesake mattered and why this one was not filed as a low finding.
This note does not describe the request. The defensive fact is the configuration that makes the bug reachable: Gateway or AAA, exposed to the network the attacker can talk to.
Which builds Citrix named
Public analyses of CTX693420 list 14.1 before 14.1-43.56, 13.1 before 13.1-58.32, 13.1-FIPS and NDcPP before 13.1-37.235, and 12.1-FIPS before 12.1-55.328. Releases 12.1 and 13.0 are end of life and do not receive a fix.
Match those floors against the build on the appliance, not against the license you bought. A pair of gateways in active/passive both need the build. The one you forgot in a branch office is the one that stays readable.
Why the patch includes killing sessions
If memory already left the box, the sessions inside it are not repaired by the new build. Citrix's guidance for this class of bug is to install the fixed build and then terminate existing sessions so stolen material stops working. Do that in a window, and tell the people who will be signed out.
End-of-life appliances do not have a build to wait for. Replace them or take the Gateway off the internet. A compensating control that leaves the virtual server up is not the mitigation in the advisory.
Order of work
Inventory every NetScaler that terminates VPN or AAA, including the ones managed by a partner. Upgrade to the fixed build for that branch, reboot as the upgrade requires, and clear sessions. Confirm both nodes of a pair.
Then look back through gateway logs from 23 June 2025, when exploitation was later reported to have started, for authentication anomalies you cannot explain. Rotate credentials that would have been in gateway memory if you cannot show the appliance was already patched. A second NetScaler bug, CVE-2025-6543, was listed by CISA on 30 June 2025. Check that one in the same change if your build is behind on both.
Coverage of CISA adding CVE-2025-5777, and the NVD record for the NetScaler bug.
https://nvd.nist.gov/vuln/detail/CVE-2025-5777
Frequently asked questions
Is Citrix Bleed 2 the same patch as 2023?
No. CVE-2025-5777 is a 2025 bug in NetScaler ADC and Gateway. CVE-2023-4966 was the earlier memory disclosure. An appliance patched in 2023 was not patched for this one.
Do I have to disconnect users?
Yes, after the fixed build is running. Sessions issued before the upgrade can carry material that was already read. Schedule the disconnect and say so.
What if the appliance is end of life?
12.1 and 13.0 do not get a fix. Replace the gateway or remove it from the network. There is no later hotfix to wait for on those branches.