CVE-2025-7775

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2025-7775 9.8

Citrix · NetScaler · Added 2025-08-26 · Published 2025-08-26

3-Day Required KEV Active Exploitation

Details

VulnerabilityCitrix NetScaler Memory Overflow Vulnerability

VendorCitrix

ProductNetScaler

Date added2025-08-26

Due date2025-08-28

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-119

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service.

NVD: Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or servicegroups bound with IPv6 servers (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with DBS IPv6 services or servicegroups bound with IPv6 DBS servers (OR) CR virtual server with type HDX

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-06-13 18:02 UTC

Wall time1.2s

Searches2

Component defaultno

Sources https://nvd.nist.gov/vuln/detail/CVE-2025-7775
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938
https://support.citrix.com/external/article/CTX694938/netscaler-adc-and-netscaler-gateway-secu.html
https://www.tenable.com/blog/cve-2025-7775-citrix-netscaler-adc-and-netscaler-gateway-zero-day-remote-code-execution
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-7775

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)

warn component_extraction: Component 'NetScaler ADC and NetScaler Gateway versions 13.1 before 13.1-59.22, 14.1 before 14.1-47.48, and 13.1-FIPS/NDcPP before 13.1-37.241' matches or contains product name 'NetScaler' — no specific component identified

Hunting hypothesis agent

Monitor for memory corruption exploitation attempts targeting NetScaler ADC and Gateway appliances configured as VPN or AAA virtual servers with IPv6-bound services.

Research details

ComponentNetScaler ADC and NetScaler Gateway versions 13.1 before 13.1-59.22, 14.1 before 14.1-47.48, and 13.1-FIPS/NDcPP before 13.1-37.241

PreconditionsNetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server; OR LB virtual servers bound with IPv6 services; OR CR virtual server with type HDX agent

DeliveryNetwork

Public PoCno

Advisoryhttps://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938

Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0)

SummaryMemory overflow vulnerability (CWE-119) in NetScaler ADC and NetScaler Gateway leading to Remote Code Execution and/or Denial of Service. Affects configurations where NetScaler acts as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy), AAA virtual server, LB virtual servers with IPv6-bound services, or CR virtual server with type HDX. Exploits observed in the wild. Patched in versions 13.1-59.22, 14.1-47.48, and 13.1-37.241 (FIPS/NDcPP).

Tia coverage

First reported2025-08-26

First exploit report2026-09-24

Exploit report → KEV394 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

citrix-netscaler-unpatched-rce-zero-days

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.