Over 28,000 Citrix devices vulnerable to new exploited RCE flaw

More than 28,200 Citrix instances are vulnerable to a critical remote code execution vulnerability tracked as CVE-2025-7775. The flaw affects NetScaler ADC and NetScaler Gateway and is already being exploited in the wild, with updates released yesterday by the vendor. According to the U.S.

Cybersecurity and Infrastructure Security Agency (CISA) and Citrix, the vulnerability has been observed in the wild and is being actively exploited; CISA has added CVE-2025-7775 to its Known Exploited Vulnerabilities (KEV) catalog. The affected versions are 14.1 before 14.1-47.48, 13.1 before 13.1-59.22, 13.1-FIPS/NDcPP before 13.1-37.241-FIPS/NDcPP, and 12.1-FIPS/NDcPP up to 12.1-55.330-FIPS/NDcPP, with Citrix advising admins to upgrade to later releases.

Internet scans by The Shadowserver Foundation show vulnerable instances across several countries, including the United States (10,100), Germany (4,300), the United Kingdom (1,400), the Netherlands (1,300), and Switzerland (1,300). Citrix also noted two additional high-severity flaws in its security bulletin and indicated that versions 12.1 and 13.0 remain vulnerable but are at End of Life status.