Citrix NetScaler Memory Overflow RCE
- Product
- Citrix NetScaler ADC / Gateway
- CVE
- CVE-2025-7775
- Disclosed
- 2025-08-26
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- NetScaler ADC/Gateway 14.1 before 14.1-47.48, 13.1 before 13.1-59.22, 13.1-FIPS/NDcPP before 13.1-37.241, 12.1-FIPS/NDcPP before 12.1-55.330, in Gateway/AAA, IPv6 load-balancing or HDX content-routing configurations.
- Fixed
- 14.1-47.48, 13.1-59.22, 13.1-FIPS/NDcPP 13.1-37.241, 12.1-FIPS/NDcPP 12.1-55.330.
Summary
A memory overflow in NetScaler appliances allowed unauthenticated remote code execution or denial of service on specific virtual server configurations. Citrix confirmed in-the-wild exploitation at disclosure and CISA added it to KEV the same day.
Root cause
An out-of-bounds memory write in the NetScaler packet engine while processing traffic for Gateway/AAA, IPv6 load balancing services or HDX content-routing virtual servers. Attacker-controlled input overflows a buffer and can be leveraged to corrupt control data.
Impact
Unauthenticated code execution or crash of the ADC, exposing the traffic and credentials it brokers.
Detection
Inventory builds against the fixed list and inspect configuration for the affected vserver types; review ns.log for nsppe crashes and look for unexpected files or webshells.
Mitigation
Upgrade to the fixed builds; there is no configuration workaround other than removing the vulnerable vserver types.