CVE-2025-5777 — exploited in the wild
CVE-2025-5777: CWE-125 Out-of-bounds Read in NetScaler ADC
Exploitation observed by OffSeq honeypot sensors · last 30 days · last seen 5 days ago · first observed 2026-09-28 (26 days ago)
Listed in CISA's Known Exploited Vulnerabilities catalog; the most recent exploitation attempt against OffSeq honeypots was 5 days ago.
About CVE-2025-5777
A malicious cyber actor exploited a Citrix NetScaler Gateway zero-day vulnerability on September 24, 2026, three days before public disclosure. The attacker, using IP address 149.104.x.x, attempted exploitation that was detected through behavioral analysis despite no CVE-specific signatures existing at the time. The exploitation chain aimed to establish persistence through a password-protected webshell, attempting to set setuid and setgid bits on /bin/sh for root access. The attacker tried to configure the web server to execute a hidden PHP webshell disguised as a CSS file, using aliases to route requests. Though unsuccessful in compromising the targeted sensor, the post-exploitation playbook revealed sophisticated techniques for maintaining access and evading detection through web server manipulation.
Vendor: NetScalerCWE-125CWE-457
OffSeq's global honeypot fleet recorded 269 exploitation attempts against CVE-2025-5777 from 16 distinct source IPs in the last 30 days — direct in-the-wild telemetry: every hit is a real attacker probing a decoy, not a scan of a vulnerability database. It is also present on 1 internet-exposed hosts OffSeq tracked in the last 30 days.