The EPSS score of 0.99959 on CVE-2025-5777 is not a false positive. It signals near-certain active exploitation in the wild — far beyond what the CVSS 7.5 rating suggests. That gap is the first thing you need to internalize: this is being exploited as a credential-harvesting mechanism, not treated as a minor information disclosure by the threat actors targeting NetScaler appliances.
The vulnerability is a memory overread in the Gateway or AAA virtual server process, triggered by input validation failure. That phrasing obscures what actually matters: Gateway and AAA virtual servers handle authentication and session establishment for VPN connections. The memory being overread is not application configuration strings — it's heap memory adjacent to active VPN sessions, meaning session cookies, NTLM hashes, SAML tokens, and partially-processed authentication buffers are within reach. This transforms what CVSS rates as "information disclosure" into something operationally equivalent to credential theft.
The overread is deterministic, not random. This significantly lowers the barrier for exploit development — an attacker with working code can trigger it reliably against specific sessions. It also means the exploitation is likely selective: targeted at high-value sessions during low-noise windows rather than sprayed broadly. Your logs may show nothing unusual because the overread produces no error code or crash — it simply reads adjacent memory and returns data.
The affected configurations narrow the attack surface but increase its value. Only Gateway components (ICA Proxy, CVPN, RDP Proxy) and AAA virtual servers are in scope. If your NetScaler runs these configurations, assume active sessions were exposed. Rotate all session tokens and credentials associated with authenticated VPN users immediately — not after you investigate, now. This is not a "patch and monitor" vulnerability; the EPSS score means assume compromise already happened through this vector.
The patch addresses the input validation failure in the specific code path, but the configuration-state nature of the trigger means you need to verify not just that the patch is applied, but that your Gateway and AAA virtual server configurations are actually remediated. A patch on a system still running vulnerable configuration is incomplete remediation.
Audit your configuration for Gateway and AAA virtual servers. Check whether adjacent heap memory from other virtual servers on the same appliance could have been exposed — in multi-tenant or multi-context deployments, this vulnerability could have leaked data from unrelated traffic streams. If you operate federated identity through this NetScaler, treat every downstream SaaS tenant and internal application as potentially compromised through harvested session assertions.
This vulnerability is not theoretical, not near-term, and not overstated by the EPSS model. The threat actors already have working code extracting authentication material from your Gateway's memory. Your priority is session rotation, not investigation.