CVE-2025-7775

9.8

CRITICAL CVSS 3.1

Citrix NetScaler Memory Overflow Vulnerability - [Actively Exploited]

Description

Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or servicegroups bound with IPv6 servers (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with DBS IPv6 services or servicegroups bound with IPv6 DBS servers (OR) CR virtual server with type HDX

INFO

Published Date :

Aug. 26, 2025, 1:15 p.m.

Last Modified :

Aug. 27, 2025, 2:26 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Aug 28, 2025

Alert Date: Aug 26, 2025 | 32 days ago

Description :

Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service.

Required Action :

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes :

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938 ; https://nvd.nist.gov/vuln/detail/CVE-2025-7775

Affected Products

The following products are affected by CVE-2025-7775 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product	Action
1	Citrix	netscaler_application_delivery_controller
2	Citrix	netscaler_gateway

: Total Affected Vendor : 1 | Products : 2

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	CRITICAL				[email protected]
	CVSS 4.0	CRITICAL				[email protected]

Solution

Update NetScaler ADC and Gateway to a fixed version to address memory corruption.

Update NetScaler ADC and Gateway to a fixed version.
Apply the latest security patches and updates from the vendor.
Review and update configurations for virtual servers.

Public PoC/Exploit Available at Github

CVE-2025-7775 has a 12 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2025-7775.

URL	Resource
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938	Vendor Advisory

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2025-7775 is associated with the following CWEs:

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2025-7775 weaknesses.

CAPEC-8: Buffer Overflow in an API Call Buffer Overflow in an API Call CAPEC-9: Buffer Overflow in Local Command-Line Utilities Buffer Overflow in Local Command-Line Utilities CAPEC-10: Buffer Overflow via Environment Variables Buffer Overflow via Environment Variables CAPEC-14: Client-side Injection-induced Buffer Overflow Client-side Injection-induced Buffer Overflow CAPEC-24: Filter Failure through Buffer Overflow Filter Failure through Buffer Overflow CAPEC-42: MIME Conversion MIME Conversion CAPEC-44: Overflow Binary Resource File Overflow Binary Resource File CAPEC-45: Buffer Overflow via Symbolic Links Buffer Overflow via Symbolic Links CAPEC-46: Overflow Variables and Tags Overflow Variables and Tags CAPEC-47: Buffer Overflow via Parameter Expansion Buffer Overflow via Parameter Expansion CAPEC-100: Overflow Buffers Overflow Buffers CAPEC-123: Buffer Manipulation Buffer Manipulation

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

abdulmyid-cyber/SIEM-Content

Zero Day SIgma rules

Updated: 14 hours, 23 minutes ago

0 stars 0 fork 0 watcher

Born at : Sept. 26, 2025, 6:28 p.m. This repo has been linked 3 different CVEs too.

technion/netscaler_scales

A mass scanner for Netscaler versions

Rust

Updated: 2 weeks, 4 days ago

0 stars 0 fork 0 watcher

Born at : Sept. 7, 2025, 1:55 a.m. This repo has been linked 1 different CVEs too.

mr-r3b00t/CVE-2025-7775

Version detection PowerShell

PowerShell

Updated: 3 weeks, 3 days ago

1 stars 1 fork 1 watcher

Born at : Sept. 2, 2025, 3:05 p.m. This repo has been linked 1 different CVEs too.

rxerium/CVE-2025-7775

Detection for CVE-2025-7775

citrix cve-2025-7775 netscaler nuclei

Updated: 3 weeks, 1 day ago

2 stars 0 fork 0 watcher

Born at : Aug. 31, 2025, 5:05 p.m. This repo has been linked 1 different CVEs too.

Aaqilyousuf/CVE-2025-7775-vulnerable-lab

None

Dockerfile Python

Updated: 4 weeks ago

0 stars 0 fork 0 watcher

Born at : Aug. 30, 2025, 7:53 a.m. This repo has been linked 1 different CVEs too.

hacker-r3volv3r/CVE-2025-7775-PoC

None

Python

Updated: 3 weeks, 3 days ago

1 stars 2 fork 2 watcher

Born at : Aug. 28, 2025, 7:22 a.m. This repo has been linked 1 different CVEs too.

mezo0x4/CVE-2025-7775

Proof of concept written in Python targeting memory overflow vulnerability leading to remote code execution in CVE-2025-7775

Updated: 4 weeks, 2 days ago

1 stars 0 fork 0 watcher

Born at : Aug. 28, 2025, 5:30 a.m. This repo has been linked 1 different CVEs too.

alukashenkov/VM-Agent

Simple AI agent for vulnerability assessment

Python HTML

Updated: 2 days, 18 hours ago

0 stars 0 fork 0 watcher

Born at : Aug. 10, 2025, 10:02 a.m. This repo has been linked 1 different CVEs too.

lgturatti/techdrops

News about technology and digital stuff

Updated: 4 days, 1 hour ago

0 stars 0 fork 0 watcher

Born at : Nov. 4, 2024, 1:06 p.m. This repo has been linked 16 different CVEs too.

ums91/CISA_BOT

CISA Bot is a GitHub bot that automatically monitors the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) Catalog. When new vulnerabilities are published in the KEV, the bot creates GitHub issues in this repository with detailed information about each vulnerability.

Python

Updated: 4 weeks ago

2 stars 1 fork 1 watcher

Born at : Oct. 29, 2024, 10:19 a.m. This repo has been linked 206 different CVEs too.

fox-it/citrix-netscaler-triage

Dissect triage scripts for Citrix NetScaler devices

citrix cve-2023-3519 dfir dissect iocs netscaler webshells cve-2025-5777 cve-2025-7775 cve-2025-6543

Python

Updated: 2 weeks, 1 day ago

58 stars 17 fork 17 watcher

Born at : Aug. 15, 2023, 1:19 p.m. This repo has been linked 6 different CVEs too.

nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 3 days, 3 hours ago

7289 stars 1207 fork 1207 watcher

Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 821 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2025-7775 vulnerability anywhere in the article.

Daily CyberSecurity

Intel’s 14A Process Will Be Its Most Expensive and Advanced Yet

Intel is currently advancing its 14A process node (equivalent to 1.4 nanometers)—the company’s first manufacturing technology designed entirely from the ground up for both Intel’s own products and its ...

Published Date: Sep 09, 2025 (2 weeks, 4 days ago)

nextron-systems.com

Detecting NetScaler Compromise with THOR During CVE-2025-7775 Attacks

Citrix NetScaler appliances are once again the target of active exploitation. On August 26, 2025, Citrix published a security advisory CTX694938 describing three critical vulnerabilities. Most notably ...