Citrix NetScaler ADC and Gateway Hit by Ongoing Attacks Exploiting 0-Day RCE

Cloud Software Group has issued an emergency security bulletin warning of active exploitation targeting three critical vulnerabilities in NetScaler ADC and NetScaler Gateway products, tracked as CVE-2025-7775, CVE-2025-7776, and CVE-2025-8424. According to Cloud Software Group, CVE-2025-7775 carries a CVSS v4.0 score of 9.2 and is actively exploited in the wild, while CVE-2025-7776 has a score of 8.8 and CVE-2025-8424 a score of 8.7, with the latter addressing improper access control.

The advisory notes that the memory overflow flaw enabling remote code execution affects NetScaler devices configured as Gateway or certain load balancer virtual servers bound with IPv6 services, and that exploitation requires no authentication over the network. It also states that CVE-2025-7776 targets Gateway configurations with PCoIP Profile bindings and that there are no workarounds available, making patching essential.

The vulnerabilities affect multiple NetScaler product lines across several version branches, and the CTX694938 security bulletin published on 26 August 2025 confirms patched versions are now available, with automatic updates for Citrix-managed cloud services.