{"id":"CVE-2025-7775","published":"2025-08-26T13:15:32Z","modified":"2026-06-17T10:05:38Z","title":"Citrix NetScaler Memory Overflow Vulnerability","vendor":"Citrix","product":"NetScaler","tier":"core","eol":null,"description":{"text":"Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server\n\n(OR)\n\nNetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or servicegroups bound with IPv6 servers \n\n(OR)\n\nNetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with DBS IPv6 services or servicegroups bound with IPv6 DBS servers\n\n(OR)\n\nCR virtual server with type HDX","provenance":"source","from":"NVD"},"summary":{"text":"Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow flaw, classed as improper restriction of operations within the bounds of a memory buffer, that affects deployments configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, as well as certain load balancing virtual servers using IPv6 services or servers and CR virtual servers of type HDX. An attacker with network access can trigger the overflow without authentication or user interaction to achieve remote code execution or denial of service, depending on the affected configuration.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:12:11Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.2067,"percentile":0.9752,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-08-26","dueDate":"2025-08-28","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938 ; https://nvd.nist.gov/vuln/detail/CVE-2025-7775","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-08-26","exploitedFirstSeen":"2025-08-26","ransomware":false,"evidence":[{"url":"https://cyberplace.social/@GossiTheDog/115095063936712306","date":"2025-08-26"},{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938&articleTitle=NetScaler_ADC_and_NetScaler_Gateway_Security_Bulletin_for_CVE_2025_7775_CVE_2025_7776_and_CVE_2025_8424","date":"2025-08-26"},{"url":"https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-citrix-6","date":"2025-08-26"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-08-26"},{"url":"https://www.tenable.com/blog/cve-2025-7775-citrix-netscaler-adc-and-netscaler-gateway-zero-day-remote-code-execution","date":"2025-08-26"},{"url":"https://www.vulncheck.com/blog/new-citrix-netscaler-zero-day-vulnerability-exploited-in-the-wild","date":"2025-08-26"},{"url":"https://x.com/DefusedCyber/status/1960376178897781168","date":"2025-08-26"},{"url":"https://blog.checkpoint.com/executive-insights/hexstrike-ai-when-llms-meet-zero-day-exploitation/","date":"2025-09-02"},{"url":"https://hs-8813571.f.hubspotemail.net/hubfs/8813571/PERISCOPE_VULNINTEL_20250903.pdf","date":"2025-09-03"},{"url":"https://www.fortiguard.com/encyclopedia/ips/58839","date":"2025-09-04"}],"evidenceTotal":17,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"references":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-7775","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Exposed NetScaler appliance exploited remotely over network","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC","start":0,"end":104}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Successful exploitation yields remote code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"leading to Remote Code Execution and/or Denial of Service","start":30,"end":87}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1499","name":"Endpoint Denial of Service","tactics":["impact"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Overflow can crash appliance causing denial of service","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service","start":0,"end":87}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-25838","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-25838","exploited":true,"exploitedSince":"2025-08-26","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":1,"earliest":"2025-08-28","earliestUrl":"https://github.com/swabird/CVE-2025-7775-PoC","repos":[{"name":"swabird/CVE-2025-7775-PoC","url":"https://github.com/swabird/CVE-2025-7775-PoC","stars":4,"created":"2025-08-28"},{"name":"rxerium/CVE-2025-7775","url":"https://github.com/rxerium/CVE-2025-7775","stars":2,"created":"2025-08-31"},{"name":"mr-r3b00t/CVE-2025-7775","url":"https://github.com/mr-r3b00t/CVE-2025-7775","stars":1,"created":"2025-09-02"}]},"first":{"date":"2025-08-28","source":"PoC-in-GitHub","url":"https://github.com/swabird/CVE-2025-7775-PoC"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059","T1499"],"provenance":"ai"}],"timeline":[{"date":"2025-08-26","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-7775","provenance":"source"},{"date":"2025-08-26","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cyberplace.social/@GossiTheDog/115095063936712306","provenance":"source"},{"date":"2025-08-26","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-08-26","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-25838","provenance":"source"},{"date":"2025-08-28","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/swabird/CVE-2025-7775-PoC","provenance":"source"}],"speed":{"daysToPublicExploit":2,"firstExploitFrom":"PoC-in-GitHub","daysToKev":0},"priority":{"score":69.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 430 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.5,"detail":"percentile 0.9752"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}