CVE-2025-5777Vulnerability
Citrix NetScaler ADC and Gateway Out-of-Bounds Read Vulnerability
Reported by 7 independent sources · first reported by GreyNoise · last reported
Last reported 27 days ago
Fix due 11 Jul 2025
Used by ransomware: knownCISA KEV catalogue
higher than 99% of CVEsFIRST EPSS, as of 19 Oct 2026
What the reports say
8 reports, newest first · the exact sentence from each-
Swarming Against Citrix 0-Day Exploitation“(Generic ${IFS} Use in RCE Attempt; CitrixBleed 2 CVE-2025-5777 Attempt)”
-
Cyber Brief 26-08 - July 2026“An initial access broker exploited CVE-2025-5777, also named CitrixBleed 2, to hijack valid Citrix NetScaler session tokens, bypassing multi-factor authentication.”
-
From ‘High/Medium/Low’ to Dollars: Making Cyber Risk Legible to Your CFO“Incidents involving Multer for Node.js, Microsoft SharePoint, CVE-2025-20337, and CVE-2025-5777 reinforced that concern.”
-
Ransomware Groups Increasingly Deploy EDR Kill Techniques“Vulnerabilities in enterprise edge devices, such as in Citrix NetScaler ADC and Gateway (CVE-2025-5777), SonicWall SSL VPN (CVE-2024-40766) and Fortinet’s FortiOS (CVE-2024-55591) were among the most exploited by ransomware groups during the reported period.”
-
CitrixBleed 2 (CVE-2025-5777) 7Steps to Dragonforce Ransomware“CitrixBleed 2 (CVE-2025-5777) 7Steps to Dragonforce Ransomware”
-
CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451)“- Citrix NetScaler Memory Disclosure (CitrixBleed 2 CVE-2025-5777)”
-
The Rise of Collaborative Tactics Among China-aligned Cyber Espionage Campaigns“Starting in July, we identified Earth Estries exploiting CVE-2025-5777 to attack Citrix devices.”
-
Exploitation of CitrixBleed 2 (CVE-2025-5777) Began Before PoC Was Public“Exploitation of CitrixBleed 2 (CVE-2025-5777) Began Before PoC Was Public”
Indicators reported together
named in the same reports- cert[.]lvin 1 report
- back-trust-aurora.cluster-ctrjumtpbmf.mnl-east-2.timcorpnet[.]comin 1 report
- afddd9d14453d4f9-1e185df7e4.ap-southeast-mnl.timcorpnet[.]comin 1 report
- 103.175.16[.]77in 1 report
- 45.92.158[.]50in 1 report
- doauthentication[.]doin 1 report
- relay.dltsolutions[.]topin 1 report
- relay.eurofin[.]digitalin 1 report
- opa.tlsd[.]shopin 1 report
- c84739655ce1af0a…bc21802209e2in 1 report
Copy these 10 indicators · defanged
Also named with it: CVE-2024-42009, CVE-2026-48294, CVE-2026-15409, CVE-2026-15410, CVE-2026-25089, CVE-2026-39808, CVE-2026-3055, CVE-2024-55591, CVE-2023-4966, CVE-2026-4368
Thanks — we review every report.