Critical vulnerabilities in NetScaler ADC exploited in-the-wild: everything you need to know

Detect and mitigate CVE-2025-5349, CVE-2025-5777, and CVE-2025-6543, Citrix Netscaler ADC and Gateway vulnerabilities being exploited in the wild. Organizations should patch urgently.

On June 17th, 2025, two critical vulnerabilities - CVE-2025-5349 and CVE-2025-5777 - were disclosed in Citrix Netscaler ADC and Netscaler Gateway, enabling unauthorized access to sensitive resources and memory overreads in specific configurations. Due to certain similarities between CVE-2025-5777 and CVE-2023-4966 (AKA “CitrixBleed”), in some publications this vulnerability has been nicknamed “CitrixBleed 2”.

On June 25, 2025, a third critical RCE vulnerability - CVE-2025-6543 - was also disclosed. This flaw affects the same products as above, with the vendor noting that it has been exploited in the wild as a 0-day. Customers are strongly advised to update to the latest fixed versions to mitigate these risks.

CVE-2025-5777 arises from insufficient input validation, leading to memory overreads. While initially described as affecting only the NetScaler Management Interface, Citrix later confirmed that the vulnerability also impacts systems configured as Gateways or AAA virtual servers—a common enterprise deployment for Citrix and RDP remote access. By sending a crafted HTTP request, an unauthenticated remote attacker could leak sensitive memory contents, including session tokens, user credentials, and other confidential artifacts. This vulnerability resembles CVE-2023-4966 (CitrixBleed), where leaked session tokens were used to hijack active remote sessions.

CVE-2025-5349 is an improper access control vulnerability affecting the NetScaler Management Interface. Exploitation requires network access to specific interfaces such as the NSIP (NetScaler IP), Cluster Management IP, or a local GSLB Site IP. If exploited successfully, attackers could gain unauthorized access to sensitive management functionality, potentially compromising administrative control over affected devices.

CVE-2025-6543 is a critical memory overflow vulnerability affecting NetScaler ADC and NetScaler Gateway. While the flaw is described as enabling denial-of-service attacks, it could potentially allow for unauthenticated remote code execution based on its CVSS score, which indicates that the vulnerability severely impacts confidentiality, integrity, and availability. CVE-2025-6543 has been confirmed by Citrix as being exploited in the wild as a 0-day prior to public disclosure.

CVE-2025-6543 affects systems configured as Gateways or AAA virtual servers, and is not directly related to CVE-2025-5777 or CVE-2023-4966.

According to Wiz data, 3.5% of cloud environments have resources vulnerable to these vulnerabilities.

ReliaQuest hasreportedobserving possible evidence of exploitation in the wild of CVE-2025-5777, and aproof-of-concept exploitfor the vulnerability was published on July 3rd, 2025. This has since been successfully tested by security teams against vulnerable organizations, indicating that by now threat actors are likely to be including it in their toolkits as well.

Citrix have stated that CVE-2025-6543 was exploited in the wild as a 0-day, but haven’t made further details public. Citrix hasadvisedcustomers interested in scanning for indicators of compromise to request this information from Citrix customer support.

The following products are vulnerable to CVE-2025-5349, CVE-2025-5777 and CVE-2025-6543:

NetScaler ADC and Gateway in versions from14.1to14.1-43.56

NetScaler ADC and Gateway in versions from13.1to13.1-58.32

NetScaler ADC in versions from13.1-FIPS/NDcPPto13.1-37.235-FIPS/NDcPP

NetScaler ADC in versions from12.1-FIPSto12.1-55.328-FIPS

Note: Versions12.1and13.0are EOL and remain vulnerable without updates.

It is recommended to upgrade to a patched version as soon as possible. Patches are available for supported versions (13.1and14.1), while end-of-life versions (12.1and13.0) remain unpatched. Organizations running affected EOL versions are urged to upgrade immediately to supported builds.

After upgrading, terminate all active ICA and PCoIP sessions using the following commands:

Kevin Beaumont haspublisheda list of IP addresses and domains identified as hosting the affected products - security teams can check if their organizations’ appliances are listed as vulnerable to CVE-2025-5777.

Based on theirown researchof CVE-2025-5777, Horizon3 have recommended checking for entries in ns.log that include non-printable characters, which may indicate successful exploitation of this vulnerability.

Given the potential for credential theft via CVE-2025-5777, it is advisable to rotate all potentially exposed passwords.

Wiz customers can use the pre-built query and advisory in theWiz Threat Centerto search for vulnerable instances in their environment:

Citrix advisory

Citrix blogpost

Kevin Beaumont's blogpost

Rapid7 blogpost

WatchTowr blogpost

ReliaQuest blogpost

Horizon3 tweet

Understanding the risks and impact of deploying dev-mode in production environments

We’re excited to announce our latest cloud security challenge series.

We believe recognition in the IDC MarketScape for CNAPP reflects our commitment to innovation and customer success across cloud security.

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings