Attention Required! | Cloudflare

Citrix is again under active attack with three new NetScaler flaws, one of which is a zero-day designated CVE-2025-7775, a memory overflow that remote attackers can exploit to hijack a system or cause a DoS via remote access or IPv6 web traffic handling. The flaw has a CVSS score of 9.2, and Citrix says exploits on unmitigated appliances have been observed, with affected builds including NetScaler ADC and Gateway versions in the 12.1, 13.1 and 14.1 release lines.

In addition, Citrix disclosed two other vulnerabilities, CVE-2025-7776 (CVSS 8.8) and CVE-2025-8424 (CVSS 8.7), involving memory handling and improper access control, respectively. Horizon3[.]ai’s Jimi Sebree notes the flaws affect components similar to the CitrixBleed family, while Tenable’s Scott Caveza highlights that many assets in use are on unsupported versions, counting nearly 20% of NetScaler assets in that category.

The US CISA lists 10 NetScaler flaws in its KEV catalog, underscoring the continuing risk to organisations that rely on these appliances for authentication and remote access. This analysis follows the 26 August 2025 publication date for the report.