CISA Issues Alert on Citrix NetScaler 0-Day RCE Exploited in the Wild

According to CISA, the Cybersecurity and Infrastructure Security Agency, a critical zero-day remote code execution vulnerability in Citrix NetScaler devices is being actively exploited in the wild. Designated CVE-2025-7775, the flaw arises from a memory overflow in NetScaler’s traffic management subsystem and has been added to the KEV Catalog.

Evidence indicates sophisticated threat actors are using this vulnerability in targeted intrusions against both public and private sector organisations, prompting CISA to urge patching as a priority. The alert references Binding Operational Directive (BOD) 22-01 and notes that FCEB agencies must remediate KEV-listed vulnerabilities by the specified deadline, while advising all organisations to address CVE-2025-7775 and other KEV entries to minimise breach risk.

CISA provides detection signatures and mitigation steps, including applying the latest Citrix NetScaler firmware update, network segmentation of management interfaces, monitoring for IOCs and anomalous processes, and reviewing audit logs for unexpected actions. Given NetScaler’s common deployment at enterprise perimeters, the guidance emphasises the high risk to government, healthcare, finance and critical infrastructure environments.