Skip to content
Whats The Hax?Practical notes with sources
← All resources

advisory

NetScaler CVE-2025-5777 advisory brief

A brief on the customer-managed NetScaler builds affected by CVE-2025-5777, the vendor's fixed builds, and the vendor’s session-termination instructions after upgrade.

CVE-2025-5777NetScalervulnerability advisory
Published
Sources checked
By
Whats The Hax editorial process

Scope and fixed builds

The vendor says CVE-2025-5777 can cause a memory overread when NetScaler is configured as a Gateway or AAA virtual server because of insufficient input validation. The bulletin covers customer-managed NetScaler ADC and Gateway; Citrix upgraded its managed cloud services.

  • NetScaler ADC or Gateway 14.1 before 14.1-43.56 is affected; 14.1-43.56 and later is fixed.
  • NetScaler ADC or Gateway 13.1 before 13.1-58.32 is affected; 13.1-58.32 and later in that branch is fixed.
  • NetScaler ADC 13.1-FIPS or 13.1-NDcPP before 13.1-37.235 is affected; 13.1-37.235 and later in those branches is fixed.
  • NetScaler ADC 12.1-FIPS before 12.1-55.328 is affected; 12.1-55.328 and later in that branch is fixed.
  • Versions 12.1 and 13.0 are end of life and vulnerable; the bulletin directs customers to a supported fixed version.

Response checklist

Inventory every standalone appliance, HA pair, cluster member, and NetScaler instance used by Secure Private Access in on-premises or hybrid deployments. Where incident handling requires it, preserve the running build and relevant logs before making changes.

  • Upgrade every member to a fixed build from the official bulletin and verify the running version afterward.
  • After upgrading every appliance in an HA pair or cluster, follow the bulletin's commands to terminate all active ICA and PCoIP sessions. Copy the commands from the vendor page to preserve their formatting and product context.
  • Review the vendor's linked detection guidance and investigate abnormal access or indicators. If the evidence points to exploitation, start incident response; an upgrade is not complete containment.

Limits

This brief summarizes bulletin CTX693420 as checked on 2026-09-07. Later builds, deployment modes, detection guidance, or mitigations may change; use the latest bulletin. It does not establish whether any specific appliance was exploited.

Sources

The source-check date records editorial review. Routine builds do not advance it.

Revision history

  • — Published from NetScaler bulletin CTX693420, including its 2026-07-20 formatting changelog entry.