CVE-2025-7775: Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2025-08-26
EPSS: 20.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-26 · updated 2026-06-17
Weakness: CWE-119

Description

Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or servicegroups bound with IPv6 servers (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with DBS IPv6 services or servicegroups bound with IPv6 DBS servers (OR) CR virtual server with type HDX

Summary

CVE-2025-7775 is a critical memory overflow in Citrix NetScaler ADC and NetScaler Gateway that can allow remote code execution and/or denial of service. It affects configurations where NetScaler acts as a Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, as well as certain load-balancing setups involving IPv6 services or HDX CR virtual servers. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation, and EPSS estimates a 20.7% chance of exploitation in 30 days. Apply the vendor fixes (12.1-55.330, 13.1-37.241, 13.1-59.22, 14.1-47.48 for ADC; 13.1-59.22 and 14.1-47.48 for Gateway) or follow vendor mitigations and BOD 22-01 guidance, and discontinue use if no mitigation is available.

تُعد CVE-2025-7775 ثغرة تجاوز سعة الذاكرة حرجة في Citrix NetScaler ADC وNetScaler Gateway، وقد تؤدي إلى تنفيذ تعليمات برمجية عن بُعد و/أو حجب الخدمة. تظهر الثغرة عندما يُضبط NetScaler كـ Gateway (خادم VPN افتراضي أو ICA Proxy أو CVPN أو RDP Proxy) أو كخادم AAA افتراضي، وكذلك في إعدادات موازنة التحميل المعينة التي تستخدم خدمات IPv6 أو خوادم HDX CR الافتراضية. الثغرة مدرجة في كتالوج CISA للثغرات المعروفة الاستغلال مع استغلال نشط، وتقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 20.7%. طبّق إصدارات الإصلاح من المورّد (12.1-55.330 و13.1-37.241 و13.1-59.22 و14.1-47.48 لـ ADC؛ و13.1-59.22 و14.1-47.48 لـ Gateway) أو اتبع تعليمات التخفيف من المورّد وإرشادات BOD 22-01، وتوقف عن استخدام المنتج إذا لم يتوفر تخفيف.

Affected products

Citrix NetScaler ADC: from 13.1 before 13.1-59.22; from 14.1 before 14.1-47.48 — fixed in 13.1-59.22, 14.1-47.48
Citrix Netscaler Application Delivery Controller Fips: from 12.1 before 12.1-55.330; from 13.1 before 13.1-37.241 — fixed in 12.1-55.330, 13.1-37.241
Citrix Netscaler Application Delivery Controller Ndcpp: from 12.1 before 12.1-55.330; from 13.1 before 13.1-37.241 — fixed in 12.1-55.330, 13.1-37.241
Citrix NetScaler Gateway: from 13.1 before 13.1-59.22; from 14.1 before 14.1-47.48 — fixed in 13.1-59.22, 14.1-47.48
NetScaler ADC: from 14.1 before 47.48; from 13.1 before 59.22; from 13.1 FIPS and NDcPP before 37.241; from 12.1 FIPS and NDcPP before 55.330 — fixed in 47.48, 59.22, 37.241, 55.330
NetScaler Gateway: from 14.1 before 47.48; from 13.1 before 59.22; from 13.1 FIPS and NDcPP before 37.241; from 12.1 FIPS and NDcPP before 55.330 — fixed in 47.48, 59.22, 37.241, 55.330

How to fix

Upgrade to a fixed version: Citrix NetScaler ADC 13.1-59.22, 14.1-47.48; Citrix Netscaler Application Delivery Controller Fips 12.1-55.330, 13.1-37.241; Citrix Netscaler Application Delivery Controller Ndcpp 12.1-55.330, 13.1-37.241; Citrix NetScaler Gateway 13.1-59.22, 14.1-47.48; NetScaler ADC 47.48, 59.22, 37.241, 55.330; NetScaler Gateway 47.48, 59.22, 37.241, 55.330. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-7775 or the next vulnerability affects your stack