Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway Under Active Exploitation
Advisory addresses three vulnerabilities that could allow for unauthenticated remote code execution, unauthorised access to the management interface, and denial-of-service. Citrix has observed exploitation of CVE-2025-7775 in the wild.
Summary
Advisory addresses three vulnerabilities that could allow for unauthenticated remote code execution, unauthorised access to the management interface, and denial-of-service. Citrix has observed exploitation of CVE-2025-7775 in the wild.
Affected platforms
The following platforms are known to be affected:
The following platforms are also known to be affected:
Secure Private Access On-Premises or Secure Private Access Hybrid deployments using NetScaler instances are also affected by the vulnerabilities.
Threat details
Exploitation of CVE-2025-7775
Citrix has reported exploitation of CVE-2025-7775 in the wild. The NHS England National CSOC assesses further exploitation as highly likely.
End of life (EoL) products still vulnerable
NetScaler ADC and NetScaler Gateway versions 12.1 and 13.0 are now End of Life (EoL) and are vulnerable. Organisations using EoL versions must upgrade to the latest release of supported versions as soon as possible.
Introduction
Citrix has released a critical security bulletin addressing three vulnerabilities affecting NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). Citrix NetScaler is an all-in-one load balancer, web application firewall (WAF), virtual private network (VPN) gateway and SSL offloading tool for web applications.
Vulnerability details
- CVE-2025-7775 is an "improper restriction of operations within the bounds of a memory buffer" vulnerability with a CVSSv4 base score of 9.2. Successful exploitation could allow an unauthenticated attacker to execute code remotely on the NetScaler appliance. CVE-2025-7775 is under active exploitation.
- CVE-2025-7776 is an "improper restriction of operations within the bounds of a memory buffer" vulnerability with a CVSSv4 base score of 8.8. Successful exploitation could allow an unauthenticated, remote attacker to cause the NetScaler appliance to exhibit unpredictable or erroneous behaviour, or to conduct a denial-of-service.
- CVE-2025-8424 is an "improper access control" vulnerability with a CVSSv4 base score of 8.7. Successful exploitation could allow a remote, unauthorised attacker to gain access to the NetScaler management interface, leading to full device takeover.
Remediation advice
Affected organisations must review Citrix Security Bulletin CTX694938 and apply the relevant update as soon as possible (detailed below).
Note: NetScaler ADC and NetScaler Gateway versions 12.1 and 13.0 are now End of Life (EoL) and no longer supported. Organisations using EoL versions must upgrade to the latest release of supported versions as soon as possible.
Remediation steps
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 26 August 2025 3:29 pm