CVE-2025-7775: Actively Exploited Critical Flaw in Citrix NetScaler

CVE-2025-7775: Actively Exploited Critical Flaw in Citrix NetScaler

Summary

In August 2025, Citrix disclosed three critical vulnerabilities in NetScaler ADC and NetScaler Gateway: CVE-2025-7775, CVE-2025-7776, and CVE-2025-8424. Of these, CVE-2025-7775 is already under active exploitation in the wild. The flaw, a memory overflow vulnerability, enables unauthenticated remote code execution (RCE) or denial of service (DoS), leaving internet-facing systems exposed to severe compromise.

There are no workarounds, and Citrix has released urgent patches. Organizations must immediately upgrade to the latest fixed builds to avoid disruption and unauthorized access.

Vulnerability Details

• CVE-2025-7775

  • Type: Memory Overflow Vulnerability

  • Impact: Remote Code Execution (RCE) / Denial of Service (DoS)

  • Exploitation: Actively exploited in the wild

  • CWE ID: CWE-119 (Memory Corruption)

  • Affected Versions:

    • NetScaler ADC and Gateway 14.1 before 14.1-47.48

    • NetScaler ADC and Gateway 13.1 before 13.1-59.22

    • NetScaler ADC 13.1-FIPS/NDcPP before 13.1-37.241-FIPS and NDcPP

    • NetScaler ADC 12.1-FIPS/NDcPP before 12.1-55.330-FIPS and NDcPP

• CVE-2025-7776

  • Another memory overflow vulnerability with potential service disruption.

  • Not yet observed in active attacks.

  • CWE ID: CWE-119.

• CVE-2025-8424

  • Improper access control vulnerability tied to the management interface.

  • Could allow privilege abuse if exploited.

  • CWE ID: CWE-284 (Improper Access Control).

A key risk factor is Hexstrike-AI, an AI-driven exploitation framework capable of weaponizing zero-day vulnerabilities in under 10 minutes. By linking LLMs with 150+ security tools, attackers can rapidly automate exploit chains against Citrix CVEs, raising the urgency for AI-powered defenses.

Recommendations

• Patch Immediately: Upgrade to the latest Citrix fixed builds:

  • 14.1-47.48, 13.1-59.22, 13.1-37.241-FIPS, 12.1-55.330-FIPS.

• Prioritize CVE-2025-7775: Treat as a critical zero-day, since it is actively exploited and enables unauthenticated RCE.

• Audit & Monitor Systems: Review logs for anomalies, deploy IDS/IPS, and conduct proactive threat hunting.

• Restrict Exposure: Keep management interfaces off the internet, enforce VPN access, and apply least privilege principles to admin accounts.

MITRE ATT&CK TTPs

• Resource Development: TA0042 (Obtain Capabilities)

• Initial Access: TA0001 (Exploitation of Public-Facing Applications – T1190)

• Execution: TA0002 (Command and Scripting Interpreter – T1059, T1203)

• Privilege Escalation: TA0004 (Exploitation for Privilege Escalation – T1068)

• Impact: TA0040 (Endpoint DoS – T1499)

• Persistence / Access: T1133 (External Remote Services), T1078 (Valid Accounts)

References

• Citrix Security Bulletin – CVE-2025-7775, CVE-2025-7776, CVE-2025-8424

• Check Point – Hexstrike-AI Zero-Day Exploitation

• MITRE ATT&CK Framework