erroneo.us
Search all guides⌘K

Security Digest · Aug 26, 2025 · Vulnerability · Network edge

NetScaler CVE-2025-7775: Exploited Pre-Auth Memory Overflow

A NetScaler ADC/Gateway memory overflow exploited as a zero-day, fixed Aug 26, 2025 in 14.1-47.48 and 13.1-59.22. Confirm builds and hunt for web shells.

Published By erroneo.us Security Desk · Updated 3 min read10 sources

Our verdict

Check exposure

Fixed since August 2025, but it was exploited before the patch to plant web shells; any appliance that ran an old build as a Gateway or AAA server back then needs a compromise check, and every NetScaler needs a far newer build today.

Who must act: Owners of customer-managed NetScaler ADC or Gateway appliances, especially Gateway, AAA, IPv6 load-balancing or HDX setups that ran builds older than 14.1-47.48 or 13.1-59.22 in August 2025.

Who can relax: Citrix-managed cloud service customers, and on-prem teams that patched on Aug 26-27, 2025, ran the compromise checks, and have kept up with every NetScaler bulletin since.

Affected
NetScaler ADC and Gateway 14.1 before 14.1-47.48
NetScaler ADC and Gateway 13.1 before 13.1-59.22
NetScaler ADC 13.1-FIPS and NDcPP before 13.1-37.241
NetScaler ADC 12.1-FIPS and NDcPP before 12.1-55.330
NetScaler 12.1 and 13.0 (end of life, no fix)
Secure Private Access on-prem or hybrid deployments using affected NetScaler instances
Fixed in
14.1-47.48, 13.1-59.22, 13.1-37.241 FIPS/NDcPP, 12.1-55.330 FIPS/NDcPP (minimum for this bulletin)
Recommended now: 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, 13.1-37.283 FIPS/NDcPP or later, per Citrix bulletin CTX697191
CVSS
9.2 (v4.0, CNA)
EPSS
20.3% (percentile 97)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Record the build of every customer-managed NetScaler with show ns version, and list which ones are Gateway, AAA, IPv6 load-balancing or HDX configurations.
  2. Upgrade anything below 14.1-73.46 or 13.1-64.29 (or the FIPS/NDcPP equivalents); a build that only fixes CVE-2025-7775 is open to several later exploited bugs.
  3. Replace 12.1 and 13.0 appliances, which are end of life and receive no fixes.
  4. If an appliance was internet-facing and unpatched on or after Aug 26, 2025, run the NCSC-NL detection script and follow up every finding.
  5. If you find a web shell, treat it as a full compromise: rebuild the appliance, rotate its certificates and stored credentials, and review access from it into the internal network.

How to check if you are affected or compromised

  • Run NCSC-NL's check script and review its log for PHP or XHTML files under /var/netscaler/ outside gui/admin_ui, setuid files in /var, and a setuid /var/tmp/sh.
  • List /var/core/ for NSPPE* core dumps from late August 2025 onward; packet-engine crashes can follow failed memory-corruption attempts.
  • Check /etc/httpd.conf for extra file extensions mapped to the PHP handler, a known way to disguise web shells.

What happened#

On August 26, 2025, Citrix published bulletin CTX694938 for three NetScaler ADC and Gateway bugs. The serious one is CVE-2025-7775, a memory overflow that can lead to unauthenticated remote code execution or denial of service. Citrix wrote that "exploits of CVE-2025-7775 on unmitigated appliances have been observed" and listed no workarounds. As CNA, it scores the bug CVSS 4.0 9.2 with high attack complexity. NVD scores it 9.8. CISA added it to the KEV catalog the same day and gave federal agencies two days to patch.

The same bulletin fixed two bugs that are not in KEV. CVE-2025-7776 (CVSS 4.0 8.8) is a memory overflow that causes denial of service on Gateways with a PCoIP profile bound. CVE-2025-8424 (8.7) is improper access control on the management interface. It requires access to the NSIP, cluster management IP, local GSLB site IP or a SNIP with management access. Citrix credited Jimi Sebree of Horizon3.ai, Jonathan Hetzer of Schramm & Partner and François Hämmerli, without saying who found which bug.

The attackers were not named. Rapid7 called them "an as-yet unknown threat actor." According to The Register, researcher Kevin Beaumont said the bug was used "as a pre-auth RCE to plant web shells on unpatched boxes." Shadowserver counted more than 28,000 vulnerable instances on August 27 and about 13,000 a day later. Most were in the US and Germany. As of Oct 23, 2026, who was behind it remains undisclosed.

Who is affected#

Customer-managed NetScaler ADC and Gateway 14.1 before 14.1-47.48 and 13.1 before 13.1-59.22, plus the FIPS and NDcPP builds listed in the bulletin. Secure Private Access on-prem and hybrid deployments that use NetScaler are also affected. Versions 12.1 and 13.0 are end of life. CVE-2025-7775 needs one of these setups: a Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server; on 13.1 and 14.1, an HTTP, SSL or HTTP_QUIC load-balancing server bound to IPv6 or DBS IPv6 services; or a CR virtual server of type HDX. The Dutch NCSC said that configuration is so common it expected large-scale abuse.

Do you really need to act?#

Yes, but the job is checking, not emergency patching for this CVE. The fix is fourteen months old. Two risks remain. First, a web shell planted before the upgrade survives it. Second, NetScaler has had several later exploited bugs. KEV added CVE-2026-3055 in March 2026, CVE-2026-8452 in August, CVE-2026-19490 and CVE-2026-88771/88772 in September, and CVE-2026-88779 in October. A box that stopped at 14.1-47.48 predates every one of those fixes, and is exposed wherever its configuration matches. Citrix's later bulletin CTX697191 recommends 14.1-73.46 and 13.1-64.29 or later.

What to do now#

  1. Run show ns version on every appliance. Search ns.conf for add vpn vserver, add authentication vserver and add cr vserver .* HDX to find exposed roles.
  2. Upgrade to 14.1-73.46, 13.1-64.29 or the matching FIPS/NDcPP build, or later.
  3. Replace 12.1 and 13.0 appliances.
  4. Run the compromise checks below on any appliance that was reachable and unpatched in late August 2025.

How to tell if you were hit#

Run the NCSC-NL detection script. NCSC-NL says it also detects compromise through later bugs. It lists PHP and XHTML files under /var/netscaler/ outside gui/admin_ui, setuid files in /var, a setuid /var/tmp/sh, and NSPPE core dumps in /var/core/. It also flags extra PHP handler extensions in /etc/httpd.conf. NCSC-NL says anything not marked "low confidence" is an indicator of compromise. If you find one, rebuild the appliance and rotate its certificates and credentials.

Timeline#

  • — Citrix publishes CTX694938 and reports exploitation. CISA adds CVE-2025-7775 to KEV. NCSC-NL warns of large-scale abuse.
  • — Shadowserver counts more than 28,000 vulnerable instances.
  • — KEV deadline; about 13,000 instances remain unpatched.

Vulnerability records

  • CVE-2025-7775 · KEV 2025-08-26 · Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as…
  • CVE-2025-7776 · Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is…
  • CVE-2025-8424 · Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway when an attacker can get access to the appliance NSIP…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Citrix — NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2025-7775, CVE-2025-7776 and CVE-2025-8424 (CTX694938) support.citrix.com
  2. CVE record — CVE-2025-7775 cve.org
  3. NVD — CVE-2025-7775 nvd.nist.gov
  4. CISA — Known Exploited Vulnerabilities: CVE-2025-7775 cisa.gov
  5. NCSC-NL — Beveiligingsadvies NCSC-2025-0268 advisories.ncsc.nl
  6. NCSC-NL — citrix-2025 webshell detection script README github.com
  7. Citrix — Security Bulletin for CVE-2026-107406 (CTX697191) support.citrix.com
  8. Rapid7 — CVE-2025-7775: Critical NetScaler Vulnerability Exploited in the Wild rapid7.com

Coverage and analysis

  1. The Register — Thousands of Citrix NetScaler boxes still sitting ducks despite patches theregister.com
  2. BleepingComputer — Citrix fixes critical NetScaler RCE flaw exploited in zero-day attacks bleepingcomputer.com