CVE-2025-7775
Description
Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or servicegroups bound with IPv6 servers (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with DBS IPv6 services or servicegroups bound with IPv6 DBS servers (OR) CR virtual server with type HDX
How to fix
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date: Aug 28, 2025- citrix netscaler_application_delivery_controller12.1-55.330, 13.1-37.241, 13.1-59.22, 14.1-47.48 or later
- citrix netscaler_gateway13.1-59.22, 14.1-47.48 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| citrix netscaler_application_delivery_controller | 12.1 ≤ v < 12.1-55.330, 13.1 ≤ v < 13.1-37.241, 13.1 ≤ v < 13.1-59.22, 14.1 ≤ v < 14.1-47.48 | 12.1-55.330, 13.1-37.241, 13.1-59.22, 14.1-47.48 |
| citrix netscaler_gateway | 13.1 ≤ v < 13.1-59.22, 14.1 ≤ v < 14.1-47.48 | 13.1-59.22, 14.1-47.48 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.