Citrix NetScaler ADC and Gateway Memory Overflow Remote Code Execution (RCE) and DoS Vulnerability (CVE-2025-7775) Urgent Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTCitrix NetScaler ADC and NetScaler Gateway versions 13.1, 14.1, 13.1-FIPS, and NDcPP configured with Gateway/AAA virtual servers, IPv6-bound HTTP/SSL/HTTP_QUIC LB virtual servers, or HDX-type CR virtual servers
Unauthenticated remote attackers can trigger a memory overflow by sending crafted network packets, leading to Remote Code Execution (RCE) or complete Denial of Service (DoS) of the appliance
Immediately upgrade to the patched versions recommended in Citrix Advisory CTX694938, restrict external access, and audit system logs for indicators of compromise
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Download the latest secure firmware release corresponding to your major version from the Citrix Support Portal. Follow the standard CLI upgrade procedure below to apply the patch.
# 1. Upload the firmware package to /var/nsinstall/ and extract it
cd /var/nsinstall/
tar -zxvf build_tgz_file.tgz
# 2. Execute the installation script with root privileges
./installns
# 3. Reboot the appliance to apply the updated firmware
reboot2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict access to the vulnerable virtual servers using Access Control Lists (ACLs) to allow traffic only from trusted source IP ranges.
# Block all untrusted external traffic to the Gateway virtual server port
add ns acl block_untrusted_ips DENY -srcIP 0.0.0.0-255.255.255.255 -destPort 443
# Allow trusted administrator or corporate VPN ranges with higher priority
add ns acl allow_trusted_ips ALLOW -srcIP 192.168.10.0-192.168.10.255 -destPort 443 -priority 10
# Apply the ACL configurations
apply ns acls3. Log Audit & IoC Verification Commands
Inspect the appliance for unexpected process crashes (NSPPE core dumps) and verify the current running configuration to determine exposure.
#!/bin/sh
echo '=== Checking NetScaler System Version ==='
nscli -c 'show ns version'
echo '
=== Checking for Recent NSPPE Core Dumps (Crash Indicators) ==='
ls -la /var/core/ | grep -i nsppe
echo '
=== Checking for Active HTTP/SSL Virtual Servers ==='
nscli -c 'show lb vserver' | grep -E 'HTTP|SSL'Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2025-7775) is a critical memory overflow vulnerability (CWE-119) residing in the memory management routines of Citrix NetScaler ADC and NetScaler Gateway. The root cause lies in the insufficient validation of incoming network packet sizes when processed by specific virtual server configurations, such as Gateway, AAA, IPv6-bound load balancing, or HDX-type Content Switching virtual servers. This allows an unauthenticated remote attacker to overwrite critical memory boundaries.
2. Exploitation Mechanics & Attack Scenario
An attacker scans for publicly exposed NetScaler appliances running vulnerable configurations (e.g., Gateway virtual servers or HTTP/SSL LB virtual servers bound with IPv6 services). By sending a sequence of malformed network packets designed to exceed allocated buffer limits, the attacker triggers a heap or stack overflow. This corruption of memory structures allows the attacker to hijack the execution flow of the NetScaler Packet Processing Engine (NSPPE), enabling arbitrary code execution with high privileges or causing the process to crash repeatedly, resulting in a Denial of Service.
3. Infrastructure & Business Impact
Citrix NetScaler appliances serve as critical entry points for enterprise application delivery and remote access. With a CVSS score of 9.8 and its inclusion in the CISA KEV catalog, this vulnerability poses an immediate threat of active exploitation. Successful exploitation grants attackers initial access to the internal network, which can be leveraged for lateral movement, sensitive data exfiltration, and deployment of ransomware, leading to catastrophic business disruption.
Official Vendor Advisories & References
Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or servicegroups bound with IPv6 servers (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with DBS IPv6 services or servicegroups bound with IPv6 DBS servers (OR) CR virtual server with type HDX
Frequently Asked SecOps Questions (CVE-2025-7775)
FAQQ1. How critical is CVE-2025-7775 and is it actively exploited in the wild?
CVE-2025-7775 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 20.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2025-7775?
Primary impacted vendors include citrix across netscaler adc, netscaler gateway. Scope summary: Citrix NetScaler ADC and NetScaler Gateway 13.1 and 14.1 (including 13.1-FIPS and NDcPP) configured as: - Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server - LB virtual servers of type HTTP, SSL, or HTTP_QUIC bound with IPv6 services/servicegroups - CR virtual server with type HDX
Q3. What temporary mitigations or workarounds exist for CVE-2025-7775 before patching?
[Mitigation] Immediately upgrade to the patched versions recommended in Citrix Advisory CTX694938, restrict external access, and audit system logs for indicators of compromise Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2025-7775
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (citrix)
View Category →Citrix NetScaler ADC and Gateway Memory Overflow Vulnerability (CVE-2026-8452) Critical Security Advisory
[Affected Scope] Citrix NetScaler ADC and NetScaler Gateway appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server
Citrix NetScaler ADC and Gateway Remote Code Execution (RCE) and DoS Vulnerability (CVE-2026-88772)
[Affected Scope] Citrix NetScaler ADC and Gateway versions prior to 14.1-73.37 and 13.1-64.23, including FIPS/NDcPP editions.
Security Advisory for NetScaler ADC and Gateway Denial of Service (DoS) Vulnerability (CVE-2026-88779)
[Affected Scope] NetScaler ADC and Gateway versions prior to 14.1-73.41 and 13.1-64.28.
Citrix NetScaler ADC and Gateway Unauthenticated Remote Code Execution (RCE) Vulnerability (CVE-2026-88771)
[Affected Scope] Citrix NetScaler ADC and Gateway versions prior to 14.1-73.37 and 13.1-64.23, including FIPS/NDcPP variants.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.