CVE-2025-7775

Assessment

Why it matters

CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 19.6%; technical severity is CVSS 9.2.

Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or servicegroups bound with IPv6 servers (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with DBS IPv6 services or servicegroups bound with IPv6 DBS servers (OR) CR virtual server with type HDX

Who should care

• Teams operating NetScaler, Netscaler Application Delivery Controller, Netscaler Gateway
• Vulnerability and exposure management teams
• Security operations teams monitoring exploitation activity

Response plan

What I would do

1. Confirm whether NetScaler, Netscaler Application Delivery Controller, Netscaler Gateway is present in the environment.
2. Identify affected versions and establish whether vulnerable services are exposed or reachable.
3. Citrix Security patch Article
4. Review relevant security telemetry for evidence of attempted or successful exploitation.
5. Document the remediation decision and track it to verified completion.

Technical details

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CWE

CWE-119

Affected versions

Citrix NetScaler; Citrix Netscaler Application Delivery Controller (Start Including 12.1, End Excluding 12.1-55.330 | Start Including 12.1, End Excluding 12.1-55.330 | Start Including 13.1, End Excluding 13.1-37.241 | Start Including 13.1, End Excluding 13.1-37.241); Citrix Netscaler Gateway (Start Including 13.1, End Excluding 13.1-59.22 | Start Including 14.1, End Excluding 14.1-47.48)

Fixed versions

Citrix Netscaler Application Delivery Controller (Fixed from 12.1-55.330, 13.1-37.241, 13.1-59.22, 14.1-47.48); Citrix Netscaler Gateway (Fixed from 13.1-59.22, 14.1-47.48)

Published

26 August 2025

Attack vector

Network

Privileges required

None

User interaction

None

Signal timeline

1. 26 Aug 2025CVE published
2. 25 Aug 2025Added to CISA KEV
3. 20 Aug 2026Latest EPSS score: 19.6%
4. 19 Aug 2026 · 12:58 UTCSignal calculated at 73

External references

• CISA Government advisory CVE-2025-7775 ↗