The software defects, which have a maximum-severity rating, do not require authentication and allow remote attackers to execute code arbitrarily on the underlying system.
The number of Citrix customers impacted by CVE-2025-5777 remains unknown, but researchers have already observed more than 11.5 million attack attempts, targeting thousands of sites.
Trend Micro researchers discovered and reported the eight-year-old defect to Microsoft six months ago. The company hasn’t made any commitments to patch or remediate the issue.
Interpol Global Complex for Innovation building is seen during the inauguration opening ceremony in Singapore on April 13, 2015. (AFP PHOTO / ROSLAN RAHMAN via Getty Images)
Ethernet cables are seen running from the back of a wireless router in Washington, D.C., on March 21, 2019. (Photo credit should read MANDEL NGAN/AFP via Getty Images)
Police officers wearing face masks guard in terminal F at Moscow’s Sheremetyevo airport on April 4, 2020. (Photo by YURI KADOBNOV/AFP via Getty Images)
Nearly half of the software exploits requested on forums were for vulnerabilities that were at least three years old, Trend Micro
found. (Getty Images)