Over 28,000 Citrix Servers at Risk from Active 0-Day RCE Exploit

A critical zero-day remote code execution vulnerability, CVE-2025-7775, is currently threatening the security of over 28,000 Citrix instances worldwide, with threat actors actively exploiting it. According to Shadowserver Foundation’s latest research, as of 26 August 2025 more than 28,200 servers remain unpatched across the globe, creating a large attack surface.

The United States and Germany host the highest numbers of exposed servers, highlighting the widespread exposure of Citrix products used for remote access and application delivery. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-7775 to its Known Exploited Vulnerabilities (KEV) catalogue, marking the vulnerability as actively exploited in the wild and prompting urgent action for organisations to patch.

Citrix has published Security Bulletin CTX694938 with remediation guidance, emphasising the need to apply patches to all affected NetScaler instances immediately.