U.S. CISA adds Citrix NetScaler flaw to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Citrix NetScaler flaw CVE-2025-7775 to its Known Exploited Vulnerabilities catalog, as reported on 27 August 2025. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, federal agencies must address the identified issues by the due date to protect networks.

The advisory notes that CVE-2025-7775 is a memory overflow vulnerability that can lead to Remote Code Execution and Denial of Service, with exploits observed on unmitigated appliances; CVE-2025-7776 and CVE-2025-8424 are also cited as part of the same NetScaler set of flaws. Cloud Software Group urges NetScaler ADC and NetScaler Gateway customers to update to versions 14.1-47.48+, 13.1-59.22+, 13.1-FIPS/NDcPP 13.1-37.241+, and 12.1-FIPS/NDcPP 12.1-55.330+ to mitigate risks, noting that no workarounds are available.

CISA states the vendor has fixed three NetScaler flaws, including CVE-2025-7775, and that federal agencies are required to remediate by 28 August 2025. The article also mentions that the company did not provide details about the attacks that exploited CVE-2025-7775.