CVE-2025-7775
Citrix NetScaler Memory Overflow Vulnerability
Description
CVE-2025-7775 is a critical memory overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway that can lead to remote code execution and denial of service. The vulnerability affects multiple NetScaler configurations including Gateway (VPN, ICA Proxy, CVPN, RDP Proxy), AAA virtual servers, and load balancer virtual servers with IPv6 services. With a CVSS v3.1 base score of 9.8, this unauthenticated remote code execution vulnerability threatens the core network infrastructure that organizations rely on for secure remote access and application delivery. CISA has added CVE-2025-7775 to the Known Exploited Vulnerabilities catalog with an unusually short remediation deadline of August 28, 2025, and its EPSS score of 10.62% at the 93rd percentile signals active, widespread exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| citrix | netscaler application delivery controller | >= 12.1, < 12.1-55.330; >= 13.1, < 13.1-37.241; >= 13.1, < 13.1-59.22; >= 14.1, < 14.1-47.48 |
| citrix | netscaler gateway | >= 13.1, < 13.1-59.22; >= 14.1, < 14.1-47.48 |
References
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-7775(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2025-7775 is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). This weakness occurs when software performs operations on a memory buffer without properly enforcing boundary limits, enabling reads or writes beyond the intended buffer region. In Citrix NetScaler, the memory overflow in request processing allows an attacker to corrupt adjacent memory, potentially overwriting control flow data to achieve remote code execution or causing service crashes that result in denial of service.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2025-7775 has a maximum-severity impact profile with catastrophic consequences for enterprise networks. The vulnerability is remotely exploitable over the network (AV:N) with low attack complexity (AC:L), requires no authentication (PR:N), and needs no user interaction (UI:N). Confidentiality (High): Successful exploitation through remote code execution gives the attacker access to all data processed by the NetScaler appliance, including VPN session data, authentication credentials, SSL/TLS certificates and private keys, and all traffic passing through the application delivery controller. Integrity (High): An attacker with code execution on the NetScaler can modify traffic in transit, inject malicious content into application responses, alter authentication flows, and install persistent backdoors. Availability (High): The memory overflow can directly cause denial of service by crashing the NetScaler process, disrupting remote access for all VPN users and application delivery for all backend services. Given that NetScaler appliances are typically deployed at the network perimeter handling critical authentication and remote access functions, compromise of these devices provides an ideal beachhead for deeper network penetration.
Exploit Maturity
CVE-2025-7775 is confirmed to be actively exploited in the wild, as evidenced by CISA adding it to the Known Exploited Vulnerabilities catalog with an exceptionally short two-day remediation deadline of August 28, 2025, just two days after the August 26 addition date. This compressed timeline indicates extreme urgency and likely widespread exploitation at the time of listing. The EPSS score of 10.62% at the 93rd percentile places it in the top 7% of all vulnerabilities by exploitation probability. Citrix has published a vendor advisory (CTX694938) with patching guidance. NetScaler appliances are high-value targets for threat actors because they sit at the network perimeter and process authentication credentials for remote access. Historical exploitation of Citrix vulnerabilities, including the widely exploited CVE-2019-19781 and CVE-2023-4966 (Citrix Bleed), demonstrates that attackers prioritize these devices for initial access into enterprise networks.
Remediation
-
Apply the Citrix security update immediately. Install the patched NetScaler versions as specified in Citrix advisory CTX694938. For NetScaler ADC: upgrade to 12.1-55.330, 13.1-37.241, 13.1-59.22, or 14.1-47.48 or later depending on your branch. For NetScaler Gateway: upgrade to 13.1-59.22 or 14.1-47.48 or later.
-
Assess exposure and prioritize affected configurations. The vulnerability affects NetScaler configured as Gateway (VPN, ICA Proxy, CVPN, RDP Proxy), AAA virtual server, load balancer virtual servers (HTTP, SSL, HTTP_QUIC) with IPv6 services, and CR virtual servers with HDX type. Identify and prioritize patching of internet-facing appliances first.
-
Conduct forensic investigation on exposed appliances. If NetScaler appliances were running vulnerable versions while internet-accessible, inspect them for signs of compromise. Check for unusual processes, unauthorized configuration changes, web shells, and suspicious log entries. Review SSL certificate and private key integrity.
-
Rotate credentials and certificates. After patching, rotate all SSL/TLS certificates and private keys stored on the NetScaler. Change all administrative passwords and LDAP/RADIUS service account credentials. Invalidate all active VPN sessions to force re-authentication.
-
Implement network monitoring and access controls. Deploy intrusion detection rules targeting memory corruption exploit patterns. Ensure the NetScaler management interface is not exposed to the internet. Implement rate limiting and anomaly detection on the public-facing virtual server interfaces.
Technical Details
CVE-2025-7775 is a memory overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates the most severe exploitability profile: network-accessible, low complexity, no authentication, and no user interaction required, with maximum impact across all CIA dimensions. The vulnerability is classified under CWE-119, indicating an improper restriction of operations within memory buffer bounds. The memory overflow occurs in the request processing logic of multiple NetScaler virtual server types. When a specially crafted request is sent to an affected virtual server, the NetScaler fails to properly validate the size of input data, causing a write beyond the intended buffer boundary. This memory corruption can be leveraged to overwrite adjacent memory structures, including control flow data, enabling the attacker to redirect execution to attacker-controlled code. The vulnerability affects multiple distinct configurations: Gateway mode (VPN, ICA Proxy, CVPN, RDP Proxy), AAA virtual servers, HTTP/SSL/HTTP_QUIC load balancer virtual servers with IPv6 services, and CR virtual servers with HDX type. Affected versions span NetScaler ADC 12.1, 13.1, 14.1, and FIPS builds.
Frequently Asked Questions
Is CVE-2025-7775 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2025-7775 to the Known Exploited Vulnerabilities catalog with an exceptionally short two-day remediation deadline, indicating extreme urgency. The EPSS score of 10.62% at the 93rd percentile further confirms widespread exploitation.
What products are affected by CVE-2025-7775?
CVE-2025-7775 affects Citrix NetScaler ADC versions 12.1 through 14.1 and NetScaler Gateway versions 13.1 and 14.1, including FIPS and NDcPP builds. The vulnerability requires specific configurations: Gateway mode, AAA virtual server, HTTP/SSL/HTTP_QUIC LB with IPv6, or CR virtual server with HDX.
How do I fix CVE-2025-7775?
Apply the Citrix security update from advisory CTX694938 immediately. The specific patched versions depend on your NetScaler branch. After patching, rotate all certificates, credentials, and service account passwords stored on or processed by the appliance.
How severe is CVE-2025-7775?
CVE-2025-7775 has a CVSS v3.1 base score of 9.8 (Critical severity). It enables unauthenticated remote code execution on NetScaler appliances, which are critical network infrastructure components. The two-day CISA remediation deadline reflects the extreme risk this vulnerability poses to enterprise networks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.