CVE-2025-7775 NetScaler ADC and Gateway Zero-Day

THE THREAT

A critical security advisory has been issued for NetScaler ADC and Gateway systems, highlighting three significant vulnerabilities (CVE-2025-7775, CVE-2025-7776, and CVE-2025-8424) that could allow Remote Code Execution (RCE), Denial-of-Service (DoS) attacks, and unauthorized access to management interfaces. Citrix confirmed that active exploitation has been observed in the wild for CVE-2025-7775 (CVSS: 9.2), making immediate patching crucial. Affected customers running versions 14.1, 13.1, and FIPS/NDcPP variants must upgrade to the latest patched versions as soon as possible, as no workarounds are available. The vulnerabilities specifically impact customer-managed installations, while cloud-managed services are automatically updated by Citrix.

What we're doing about it

• eSentire’s Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to CVE-2025-7775
• eSentire's MDR for Log has detections in place to identify suspicious remote access and command execution for NetScaler appliances
• eSentire's Threat Response Unit (TRU) is actively tracking this topic for additional detection opportunities

What you should do about it

• After performing a business impact review, apply the relevant security patches released by Citrix
  • NetScaler ADC and NetScaler Gateway 14.1-47.48 and later releases
  • NetScaler ADC and NetScaler Gateway 13.1-59.22 and later releases of 13.1
  • NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.241 and later releases of 13.1-FIPS and 13.1-NDcPP
  • NetScaler ADC 12.1-FIPS and 12.1-NDcPP 12.1-55.330 and later releases of 12.1-FIPS and 12.1-NDcPP
  • Upgrade End-of-Life (EoL) appliance if used
• Ensure NetScaler logs are integrated with eSentire MDR for Logs, specifically, the following log source should be forwarded to the SIEM:
  • System/Audit log – ns.log
  • Authentication/AAA debug log - aaad.debug
  • Application Firewall log - appfw.log
  • HTTP request log – httprequest.log
  • VPN audit/session logging (Optional but recommended)
  • Nitro/API audit (Optional but recommended)
• Inspect for the presence of possible webshells on your NetScaler appliance
  • A Webshell inspection script has been made available by National Cyber Security Centre Netherland

Additional information

CVE-2025-7775 presents a memory overflow condition that can lead to pre-authenticated RCE and DoS. The flaw particularly affects systems configured as Gateway services (VPN virtual server, ICA Proxy, CVPN, RDP Proxy), AAA virtual servers, or those utilizing specific IPv6 configurations with HTTP, SSL, or HTTP_QUIC load balancing virtual servers. At the time of writing, no technical details related to the exploit are available, though researcher Kevin Beaumont has suggested it may have been exploited to deploy webshells.

Two additional vulnerabilities compound the risk: CVE-2025-7776 (CVSS 8.8) targets systems with PCoIP Profile configurations, causing memory overflow issues and potential system instability, while CVE-2025-8424 (CVSS 8.7) exposes a significant access control vulnerability in the NetScaler Management Interface, potentially affecting any system with access to NSIP, Cluster Management IP, or local GSLB Site IP configurations. All supported versions are affected, including NetScaler ADC and Gateway 14.1 (pre-14.1-47.48), 13.1 (pre-13.1-59.22), and various FIPS/NDcPP implementations.

Immediate patching is critical for all customer-managed installations, as no workarounds exist. Organizations running older versions 12.1 and 13.0, now End of Life (EoL), must upgrade to supported versions immediately. The vulnerabilities impact systems using authentication servers (AAA vServer), Gateway configurations, specific load balancing configurations with IPv6 services, and CR virtual servers with HDX types. While customer-managed systems require manual updating, Citrix-managed cloud services and Adaptive Authentication implementations are being automatically patched by Cloud Software Group.

Earlier this year, threat actors targeted Citrix NetScaler ADC and NetScaler Gateway, reportedly exploiting critical vulnerabilities, CVE-2025-6543 (CVSS 9.2) and CVE-2025-5777 (CVSS: 9.3), in the wild as of June 2025. Given the severity, confirmed exploitation, and continued threat actor interest in Citrix appliances, organizations should urgently mitigate CVE-2025-7775 by applying the relevant security patches immediately.

Impacted Versions List:

• NetScaler ADC and NetScaler Gateway 14.1 before 14.1-47.48
• NetScaler ADC and NetScaler Gateway 13.1 before 13.1-59.22
• NetScaler ADC 13.1-FIPS and NDcPP before 13.1-37.241-FIPS and NDcPP
• NetScaler ADC 12.1-FIPS and NDcPP before 12.1-55.330-FIPS and NDcPP

References:

[1] https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938&articleTitle=NetScaler_ADC_and_NetScaler_Gateway_Security_Bulletin_for_CVE_2025_7775_CVE_2025_7776_and_CVE_2025_8424
[2] https://www.cve.org/CVERecord?id=CVE-2025-7775
[3] https://github.com/NCSC-NL/citrix-2025/tree/main/live-host-bash-check
[4] https://cyberplace.social/@GossiTheDog/115095063936712306
[5] https://www.cve.org/CVERecord?id=CVE-2025-7776
[6] https://www.cve.org/CVERecord?id=CVE-2025-8424
[7] https://www.esentire.com/security-advisories/actively-exploited-citrix-vulnerability-cve-2025-6543
[8] https://nvd.nist.gov/vuln/detail/CVE-2025-6543
[9] https://nvd.nist.gov/vuln/detail/CVE-2025-5777