Citrix Patches Exploited NetScaler Zero-Day

Citrix has released patches for three NetScaler vulnerabilities, including a critical zero-day that was exploited in the wild, prompting emergency patch deadlines for federal agencies. Tracked as CVE-2025-7775 (CVSS 9.2), the flaw is a memory overflow that can cause DoS and, in some scenarios, remote code execution, and it affects NetScaler instances configured as a gateway or as an AAA virtual server, among other specific bindings.

In addition to CVE-2025-7775, the company patched CVE-2025-7776 (CVSS 8.8) and CVE-2025-8424 (CVSS 8.7), addressing further memory overflow issues and improper access control in NetScaler’s management interface. As of 26 August 2025, Cloud Software Group noted that exploits on unmitigated appliances have been observed and urged customers to upgrade to fixed firmware, with no mitigations available.

CISA added CVE-2025-7775 to its Known Exploited Vulnerabilities catalog, and federal agencies were given two days to patch under the Binding Operational Directive 22-01, rather than the usual three weeks. according to CISA. Written by Ionut Arghire, SecurityWeek reports the updated NetScaler versions 14.1-47.48, 13.1-59.22, 13.1-FIPS, 13.1-NDcPP 13.1-37.241, and 12.1-FIPS, 12.1-NDcPP 12.1-55.330 contain the fixes.