CVE-2025-7775: Actively Exploited Critical Flaw in Citrix NetScaler

CVE-2025-7775: Actively Exploited Critical Flaw in Citrix NetScaler

Summary

Citrix has disclosed three critical vulnerabilities in NetScaler ADC and NetScaler Gateway: CVE-2025-7775, CVE-2025-7776, and CVE-2025-8424. Among these, CVE-2025-7775 is the most severe, as it is already under active exploitation in the wild. This memory overflow vulnerability enables unauthenticated remote code execution (RCE) or denial of service (DoS), posing a critical zero-day threat. The other flaws, CVE-2025-7776 (memory overflow) and CVE-2025-8424 (improper access control), have not yet been observed in active attacks but present significant security risks. Citrix warns that there are no workarounds, making immediate patching essential to prevent compromise and disruption.

Vulnerability Details

• CVE-2025-7775 – Memory overflow vulnerability enabling unauthenticated RCE/DoS, confirmed as actively exploited.

• CVE-2025-7776 – Memory overflow bug that could result in service disruption.

• CVE-2025-8424 – Improper access control vulnerability affecting management interfaces.

These flaws impact:

• NetScaler ADC and Gateway 14.1 before 14.1-47.48

• NetScaler ADC and Gateway 13.1 before 13.1-59.22

• NetScaler ADC 13.1-FIPS/NDcPP before 13.1-37.241

• NetScaler ADC 12.1-FIPS/NDcPP before 12.1-55.330

The vulnerabilities are classified under CWE-119 (Memory Overflow) and CWE-284 (Access Control).

Recommendations

1. Patch Immediately – Upgrade all affected NetScaler appliances to the fixed versions:

   • 14.1-47.48 or later

   • 13.1-59.22 or later

   • 13.1-37.241-FIPS/NDcPP or later

   • 12.1-55.330-FIPS/NDcPP or later

2. Prioritize CVE-2025-7775 – Treat as critical since exploitation is ongoing. If patching cannot be immediate, restrict external access until updates are applied.

3. Audit and Monitor Systems – Continuously review logs, authentication attempts, and anomalous activity. Deploy intrusion detection and conduct proactive threat hunting.

4. Limit Exposure – Keep management interfaces off the public internet and apply least-privilege access for administrative accounts.

MITRE ATT&CK TTPs

• Tactics: Resource Development (TA0042), Initial Access (TA0001), Execution (TA0002), Privilege Escalation (TA0004), Impact (TA0040).

• Techniques:

  • Exploit Public-Facing Application (T1190)

  • Endpoint Denial of Service (T1499)

  • Command and Scripting Interpreter (T1059)

  • Exploitation for Privilege Escalation (T1068)

  • Exploitation for Client Execution (T1203)

  • External Remote Services (T1133)

  • Valid Accounts (T1078)

  • Vulnerabilities (T1588.006), Exploits (T1588.005), Obtain Capabilities (T1588)

References

• Citrix Security Bulletin – NetScaler ADC and Gateway CVE-2025-7775, CVE-2025-7776, CVE-2025-8424