Over 28,000 Citrix instances remain exposed to critical RCE flaw CVE-2025-7775

Shadowserver Foundation researchers warn that more than 28,200 Citrix NetScaler ADC and Gateway instances remain vulnerable to CVE-2025-7775, a memory overflow flaw that enables remote code execution and has been observed exploited in the wild. The advisory notes a CVSS score of 9.2 for CVE-2025-7775, and Citrix has addressed three NetScaler flaws including this one; exploits on unmitigated appliances have been observed. The U.S.

Cybersecurity and Infrastructure Security Agency (CISA) added the Citrix NetScaler flaw to its Known Exploited Vulnerabilities catalog, with federal agencies required to fix the vulnerabilities by 28 August 2025. Shadowserver data show the majority of vulnerable instances are in the United States (10,100), followed by Germany (4,300), the United Kingdom (1,400), the Netherlands (1,300) and Switzerland (1,300).

The report highlights that more than 28,000 devices remain exposed as the August 26, 2025 alert window closed, underscoring the ongoing risk of exploitation across the affected networks.