{"id":"CVE-2025-7775","kind":"vulnerability","aliases":["CVE-2025-7775"],"related":[],"title":"Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and…","description":"Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server\n\n(OR)\n\nNetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or servicegroups bound with IPv6 servers \n\n(OR)\n\nNetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with DBS IPv6 services or servicegroups bound with IPv6 DBS servers\n\n(OR)\n\nCR virtual server with type HDX","summary":"Citrix NetScaler ADC and NetScaler Gateway have a memory overflow that can allow remote code execution or denial of service. CISA lists it as actively exploited in the wild, so an attacker may run code on the appliance without a login.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2025-08-26T00:00:00+00:00","products":[{"name":"Citrix NetScaler","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"citrix netscaler application delivery controller","fixed":["12.1-55.330"],"affected":">= 12.1, < 12.1-55.330","ecosystem":"vendor"},{"name":"citrix netscaler application delivery controller","fixed":["13.1-37.241"],"affected":">= 13.1, < 13.1-37.241","ecosystem":"vendor"},{"name":"citrix netscaler application delivery controller","fixed":["13.1-59.22"],"affected":">= 13.1, < 13.1-59.22","ecosystem":"vendor"},{"name":"citrix netscaler application delivery controller","fixed":["14.1-47.48"],"affected":">= 14.1, < 14.1-47.48","ecosystem":"vendor"},{"name":"citrix netscaler gateway","fixed":["13.1-59.22"],"affected":">= 13.1, < 13.1-59.22","ecosystem":"vendor"},{"name":"citrix netscaler gateway","fixed":["14.1-47.48"],"affected":">= 14.1, < 14.1-47.48","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["citrix","exploited","infrastructure","netscaler","netscaler-gateway","self-hosted"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the vendor mitigation or patch from Citrix for CVE-2025-7775; the sources do not name the fixed version. If no mitigation exists, CISA says to discontinue use of the product.","status":"open","published_at":"2025-08-26T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:46:28+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:46:28Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or patch from Citrix for CVE-2025-7775; the sources do not name the fixed version. If no mitigation exists, CISA says to discontinue use of the product.","reach":"internet","summary":"Citrix NetScaler ADC and NetScaler Gateway have a memory overflow that can allow remote code execution or denial of service. CISA lists it as actively exploited in the wild, so an attacker may run code on the appliance without a login.","category":"infrastructure","who_cares":["citrix","netscaler","netscaler-gateway","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs code on the NetScaler appliance and may crash it.","analyst_note":"Find the affected and fixed NetScaler versions and the Citrix mitigation steps in the Citrix security bulletin for CVE-2025-7775, and confirm whether authentication is required.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000451,"input_tokens":2532,"output_tokens":395,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':17A,20A '-7775':18A,21A '13.1':143C,145C,175C,177C '14.1':144C,176C 'aaa':134C 'activ':84B 'adc':15A,62B,115C,139C,171C 'allow':72B 'and/or':9A,109C 'applianc':97B 'application':26A,31A,36A,41A 'attack':91B 'bound':159C,165C,191C,198C 'cisa':80B 'citrix':22A,24A,29A,34A,39A,44A,47A,50B,60B 'code':7A,74B,94B,107C 'configur':122C 'controller':28A,33A,38A,43A 'cr':204C 'cve':16A,19A 'cvpn':130C 'dbs':193C,201C 'delivery':27A,32A,37A,42A 'denial':10A,77B,110C 'execut':8A,75B,108C 'exploit':51B,85B 'fip':146C,178C 'gateway':46A,49A,56B,65B,118C,124C,142C,174C 'hdx':209C 'host':59B 'http':154C,157C,186C,189C 'ica':128C 'infrastructur':52B 'ipv6':161C,167C,194C,200C 'lb':149C,181C 'lead':4A,104C 'list':81B 'login':100B 'may':92B 'memori':1A,68B,101C 'ndcpp':148C,180C 'netscal':14A,53B,55B,61B,64B,114C,117C,120C,138C,141C,170C,173C 'netscaler':23A,25A,30A,35A,40A,45A,48A 'netscaler-gateway':54B 'overflow':2A,69B,102C 'proxi':129C,132C 'quic':158C,190C 'rdp':131C 'remot':6A,73B,106C 'run':93B 'self':58B 'self-host':57B 'server':127C,136C,151C,168C,183C,202C,206C 'servic':12A,79B,112C,162C,195C 'servicegroup':164C,197C 'ssl':155C,187C 'type':153C,185C,208C 'virtual':126C,135C,150C,182C,205C 'vpn':125C 'vulner':3A,103C 'wild':88B 'without':98B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-08-26T00:00:00+00:00","kev":{"dateAdded":"2025-08-26","dueDate":"2025-08-28","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"secure@citrix.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-7775","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-7775","severity":null,"published_at":"2025-08-26T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:32+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-7775","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-7775","severity":null,"published_at":"2025-08-26T13:15:32+00:00","modified_at":"2026-06-17T10:05:38+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}