Citrix fixes critical NetScaler RCE flaw exploited in zero-day attacks

Citrix has fixed three NetScaler flaws, including a critical remote code execution vulnerability tracked as CVE-2025-7775 that was observed being exploited in zero‑day attacks on unpatched devices, according to Citrix.

The memory overflow flaw can lead to unauthenticated, remote code execution, and the update also addresses a memory overflow vulnerability that could cause a denial‑of‑service, tracked as CVE-2025-7776, along with improper access control on the NetScaler Management Interface, tracked as CVE-2025-8424.

In an advisory released today, Citrix states that exploits of CVE-2025-7775 on unmitigated appliances have been observed, and strongly recommends administrators upgrade to the fixed firmware as there are no mitigations. The flaws affect specific NetScaler versions and configurations, including NetScaler ADC and NetScaler Gateway in various 13.x and 14.x builds and certain IPv6‑bound LB setups, with a list of vulnerable configurations provided in the advisory. Citrix credits Jimi Sebree of Horizon3[.]ai, Jonathan Hetzer of Schramm & Partnerfor, and François Hämmerli for disclosure.