NetScaler ADC and Gateway / Cisco ISE exploited zero-day flaws (multiple vulnerabilities)
Vulnerability
Summary
Hide ▲
Show ▼
CVE-2025-5777 and CVE-2025-20337 were exploited as zero-days against NetScaler ADC and Gateway and Cisco ISE, creating pre-disclosure compromise risk before fixes were broadly available. The activity mattered because attackers used the flaws to deploy custom malware and gain high-privilege access on vulnerable systems. One flaw, Citrix Bleed 2, was an out-of-bounds memory read issue, while the Cisco ISE bug enabled pre-auth abuse of vulnerable endpoints.
Related Happenings
Cloud Software Group NetScaler urgent remediation advisory
Advisory/Mitigation
H score44
First: 25.03.2026 17:52
Last: 25.03.2026 17:52
Sources 1
About this happening:
Cloud Software Group issued urgent remediation guidance for NetScaler ADC and NetScaler Gateway, telling affected customers to install updated versions as soon as poss...
Cloud Software Group NetScaler urgent remediation advisory
Advisory/MitigationAbout this happening: Cloud Software Group issued urgent remediation guidance for NetScaler ADC and NetScaler Gateway, telling affected customers to install updated versions as soon as poss...
Interlock Cisco Secure Firewall Management Center zero-day exploitation wave
Exploitation Wave
H score59
First: 18.03.2026 18:53
Last: 18.03.2026 18:53
Sources 1
About this happening:
A zero-day exploitation wave tied to Interlock has been hitting Cisco Secure Firewall Management Center (FMC), putting enterprise firewalls at risk before patching...
Interlock Cisco Secure Firewall Management Center zero-day exploitation wave
Exploitation WaveAbout this happening: A zero-day exploitation wave tied to Interlock has been hitting Cisco Secure Firewall Management Center (FMC), putting enterprise firewalls at risk before patching...
Cisco Catalyst SD-WAN active exploitation wave
Exploitation Wave
H score57
First: 05.03.2026 14:15
Last: 05.03.2026 14:15
Sources 1
About this happening:
Cisco confirmed active exploitation of two recently patched Catalyst SD-WAN vulnerabilities, creating immediate risk for exposed systems that have not been fully remed...
Cisco Catalyst SD-WAN active exploitation wave
Exploitation WaveAbout this happening: Cisco confirmed active exploitation of two recently patched Catalyst SD-WAN vulnerabilities, creating immediate risk for exposed systems that have not been fully remed...
Cisco ISE and ISE-PIC XML parsing arbitrary file read security flaw (CVE-2026-20029)
Vulnerability
H score43
First: 08.01.2026 11:13
Last: 08.01.2026 11:13
Sources 1
About this happening:
Cisco has patched CVE-2026-20029 in ISE and ISE-PIC, closing an XML parsing flaw that could let an attacker with valid administrative credentials read arbitr...
Cisco ISE and ISE-PIC XML parsing arbitrary file read security flaw (CVE-2026-20029)
VulnerabilityAbout this happening: Cisco has patched CVE-2026-20029 in ISE and ISE-PIC, closing an XML parsing flaw that could let an attacker with valid administrative credentials read arbitr...
Cisco ISE and Citrix NetScaler ADC zero-day malware delivery campaign
Campaign
H score39
First: 12.11.2025 16:00
Last: 12.11.2025 16:00
Sources 1
About this happening:
A zero-day exploitation campaign against Cisco ISE and Citrix NetScaler ADC is delivering custom malware into enterprise identity and network access control infras...
Cisco ISE and Citrix NetScaler ADC zero-day malware delivery campaign
CampaignAbout this happening: A zero-day exploitation campaign against Cisco ISE and Citrix NetScaler ADC is delivering custom malware into enterprise identity and network access control infras...
Timeline
-
12.11.2025 16:00 2 articles · 8mo ago
Amazon reports zero-day exploitation of Citrix and Cisco flaws
Initial DisclosureAmazon said an advanced threat actor used CVE-2025-5777 in NetScaler ADC and Gateway and CVE-2025-20337 in Cisco Identity Service Engine (ISE) as zero-days to deploy custom malware, and Amazon Threat Intelligence shared an anomalous payload with Cisco that targeted a previously undocumented ISE endpoint using vulnerable deserialization logic.
Show sources
- Hackers exploited Citrix, Cisco ISE flaws in zero-day attacks — www.bleepingcomputer.com — 12.11.2025 16:00
- Hackers exploited Citrix, Cisco ISE flaws in zero-day attacks — www.bleepingcomputer.com — 12.11.2025 16:00
-
28.07.2025 03:00 1 articles · 11mo ago
Bobby Gould publishes CVE-2025-20337 exploit details
Technical Analysis UpdateResearcher Bobby Gould published technical details for CVE-2025-20337 in Cisco Identity Service Engine (ISE), including an exploit chain for the vulnerability.
Show sources
- Hackers exploited Citrix, Cisco ISE flaws in zero-day attacks — www.bleepingcomputer.com — 12.11.2025 16:00
-
17.07.2025 03:00 1 articles · 12mo ago
Cisco warns on CVE-2025-20337 in Cisco ISE
Initial DisclosureCisco warned that CVE-2025-20337 in Cisco Identity Service Engine (ISE) could let an unauthenticated attacker store malicious files, execute arbitrary code, or gain root privileges on vulnerable devices.
Show sources
- Hackers exploited Citrix, Cisco ISE flaws in zero-day attacks — www.bleepingcomputer.com — 12.11.2025 16:00