Citrix NetScaler “CitrixBleed 2” (CVE-2025-5777) plus CVE-2025-6543
Disclosed 17 Jun 2025. Memory over-read leaks session tokens.
- Disclosed
What happened
- KEV: CVE-2025-6543 on 30 Jun 2025. CVE-2025-5777 on 10 Jul 2025, with a one-day federal deadline.
- Follow-up: CVE-2025-7775 RCE, in KEV 25 Aug 2025.
Live scores
Live scores
CVE-2025-5777- EPSS
- 1.000
very likely to be attacked soon - VEDAS
- 0.989
strong exploit evidence - On CISA KEV
- Yes, since 2025-07-10
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Live scores
CVE-2025-6543- EPSS
- 0.104
likely to be attacked soon - VEDAS
- 0.972
strong exploit evidence - On CISA KEV
- Yes, since 2025-06-30
- Detection rule
- None yet
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.
Live scores
CVE-2025-7775- EPSS
- 0.207
likely to be attacked soon - VEDAS
- 0.984
strong exploit evidence - On CISA KEV
- Yes, since 2025-08-26
Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish.
Sources
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420
- https://nvd.nist.gov/vuln/detail/CVE-2025-5777
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.