CVE-2025-7775: Citrix NetScaler memory overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 4.0 base score 9.2, CISA KEV listing with a two-day remediation deadline, and a 97th percentile EPSS score indicate active exploitation of an internet-facing edge appliance.

What it is

NetScaler ADC and NetScaler Gateway contain a memory buffer overflow (CWE-119) that can lead to remote code execution or denial of service. It affects Gateway-configured deployments (VPN virtual server, ICA Proxy, CVPN, RDP Proxy), AAA virtual servers, and specific load-balancing or CR virtual server configurations involving IPv6 services or HDX. Because these are edge appliances, a compromise exposes the network perimeter.

Impact

A remote attacker can execute code on the appliance or crash it, gaining a foothold on an internet-facing system or disrupting access for all users.

Attack surface

Reachable over the network (AV:N) with no authentication (PR:N) and no user interaction (UI:N), but exploitation requires specific conditions (AC:H, AT:P) and a vulnerable configuration such as a Gateway, AAA, or IPv6-bound load-balancing virtual server.

Exploitation

Listed in CISA KEV with a 2025-08-26 addition and a 2025-08-28 remediation due date, indicating known exploitation; EPSS 30-day probability is about 19.6 percent (97th percentile). No ransomware campaign use is documented.

What to do

• Apply the Citrix vendor update referenced in CTX694938 immediately; this is the primary fix.
• If patching cannot be done at once, follow Citrix mitigation guidance or take the appliance out of service per CISA BOD 22-01.
• Restrict management and VPN/AAA virtual server exposure to trusted networks where operationally possible.
• Review configurations for the affected Gateway, AAA, IPv6-bound load-balancing, and HDX CR virtual server setups and disable unused ones.
• Monitor Citrix and CISA advisories for updated guidance until fully remediated.

Detection

• Review NetScaler and Citrix Gateway logs for crashes, unexpected restarts, or memory-related errors on affected virtual servers.
• Hunt for unusual outbound connections, new processes, or file changes on NetScaler appliances that could indicate post-exploitation.
• Alert on anomalous traffic to Gateway, AAA, or IPv6-bound load-balancing virtual servers from untrusted sources.
• Correlate appliance logs with authentication and access logs to spot exploitation attempts or follow-on lateral movement.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.