Actively exploited · CISA KEV
Actively exploitedCVE-2025-5777
- First PoC
- 28 days →KEV
- 446 days →First cited attacker
Signals
- Exploited in the wild
- Yesadded 2025-07-10 · due 2025-07-11 · known ransomware use. An observation, not a forecast.
- EPSS · 30-day forecast
- 100.0%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
- CVSS · NVD
- not stated by sourcesNo NVD record yet.
- Internet exposure
- not stated by sourcesNo exposure census on this CVE's dispatches.
Exploits
28 known · links onlyGitHub PoCs · by trust, then stars26
- win3zz/CVE-2025-5777 ↗Trust ok 100
CVE-2025-5777 (CitrixBleed 2) - Critical memory leak vulnerability affecting Citrix NetScaler ADC and Gateway devices
★ 50 · created 2025-07-08
- bughuntar/CVE-2025-5777 ↗Trust ok 100
CVE-2025-5777 Citrix NetScaler Memory Leak Exploit (CitrixBleed 2)
★ 31 · created 2025-07-10
- mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC- ↗Trust ok 100
详细讲解CitrixBleed 2 — CVE-2025-5777（越界泄漏）PoC 和检测套件
★ 17 · created 2025-06-30
- Chocapikk/CVE-2025-5777 ↗Trust ok 100
CitrixBleed 2 (CVE-2025-5777)
★ 7 · created 2025-07-08
PoC for CVE-2025-5777 – Auth Bypass and RCE in Trend Micro Apex Central
★ 5 · created 2025-07-23
- soltanali0/CVE-2025-5777-Exploit ↗Trust ok 100
★ 5 · created 2025-08-07
- cyberleelawat/ExploitVeer ↗Trust ok 100
An advanced, powerful, and easy-to-use tool designed to detect and exploit CVE-2025-5777 (CitrixBleed 2). This script not only identifies the vulnerability but also helps in demonstrating its impact by parsing human-readable information from the memory leak.
★ 3 · created 2025-07-15
- ndr-repo/CVE-2025-5777 ↗Trust ok 100
Exploit for CVE-2025-5777: Citrix NetScaler Memory Disclosure (CitrixBleed 2)
★ 3 · created 2025-08-20
- nocerainfosec/cve-2025-5777 ↗Trust ok 100
Memory disclosure vulnerability in Citrix NetScaler ADC and Gateway when configured as a Gateway (VPN virtual server, ICA proxy, CVPN, RDP Proxy).
★ 3 · created 2025-07-05
- orange0Mint/CitrixBleed-2-CVE-2025-5777 ↗Trust ok 100
CitrixBleed-2 Checker & Poc automatic exploit and check token.
★ 2 · created 2025-07-06
- RickGeex/CVE-2025-5777-CitrixBleed ↗Trust ok 100
CitrixBleed-2 (CVE-2025-5777) – proof-of-concept exploit for NetScaler ADC/Gateway “memory bleed”
★ 1 · created 2025-07-04
- 0xBlackash/CVE-2025-5777 ↗Trust ok 100
CVE-2025-5777
★ 0 · created 2026-03-02
- 0xgh057r3c0n/CVE-2025-5777 ↗Trust ok 100
Citrix NetScaler Memory Leak PoC
★ 0 · created 2025-07-10
- below0day/Honeypot-Logs-CVE-2025-5777 ↗Trust ok 100
CitrixBleed 2 NetScaler honeypot logs
★ 0 · created 2025-07-30
- FrenzisRed/CVE-2025-5777 ↗Trust ok 100
CitrixBleed2 powershell version
★ 0 · created 2025-07-09
- idobarel/CVE-2025-5777 ↗Trust ok 100
CitrixBleed2 poc
★ 0 · created 2025-07-05
- maxprog-svg/CitrixBleedCVE-2026-8452-2025-5777 ↗Trust ok 100
CitrixBleed Exploit Tool - CVE-2025-5777 & CVE-2026-8452. Unauthenticated remote memory read from Citrix NetScaler ADC & Gateway. Steal admin session tokens, extract nsroot hashes, dump secrets, and bypass MFA. Python 3 exploit with full memory parsing.
★ 0 · created 2026-08-30
- mr-r3b00t/CVE-2025-5777 ↗Trust ok 100
placeholder for CitrixBleed 2.0 CVE-2025-5777
★ 0 · created 2025-11-16
- nicecopy/POC-CVE-2025-5777 ↗Trust ok 100
★ 0 · created 2025-07-24
- RaR1991/citrix_bleed_2 ↗Trust ok 100
Citrix Bleed 2 PoC Scanner (CVE-2025-5777)
★ 0 · created 2025-07-06
- rashedhasan090/CVE-2025-5777 ↗Trust ok 100
★ 0 · created 2025-11-23
CVE Reproduction: cve-2025-5777-citrixbleed2_reproduction
★ 0 · created 2026-07-23
Update the old POC of CVE-2025-5777 Citrix NetScaler Memory leak
★ 0 · created 2025-08-11
- sentinel-aidefense/CVE-2025-5777 ↗Trust ok 100
CVE-2025-5777 Research writeup
★ 0 · created 2026-07-02
- Sheep-Hunter/CVE-2025-5777-POC ↗Trust ok 100
★ 0 · created 2025-08-20
- SleepNotF0und/CVE-2025-5777 ↗Trust ok 100
CVE-2025-5777 (CitrixBleed 2) - [Citrix NetScaler ADC] [Citrix Gateway]
★ 0 · created 2025-07-15
Fake proof-of-concept repositories have been used to deliver malware to the researchers who run them. The trust verdict is our engine's heuristic over the repository (account age, what it ships, how its stars arrived); it is a reason to read the code first, not a finding about its author.
Exploit-DB1
created 2025-08-11
Nuclei1
Insufficient input validation leading to memory overread on the NetScaler Management Interface NetScaler ADC and NetScaler Gateway
yaml · seen 2026-10-18
On the wire
0 dispatchesNo dispatch on our wire has named this CVE yet.
Watch this one?
KEV additions reach Telegram and the KEV-only RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.