Redazione RHC : 28 August 2025 14:02
NetScaler has alerted administrators of three new vulnerabilities in NetScaler ADC and NetScaler Gateway, one of which is already being used in active attacks. Updates are available and the vendor urges you to install them immediately: exploits for CVE-2025-7775 have been discovered on unprotected devices.
The bugs include a memory overflow with the potential for code execution and denial of service, a second similar bug causing service crashes and unpredictable behavior, and an access control issue in the management interface. The bugs affect both standard releases and FIPS/NDcPP-compliant builds. Updates have already been deployed for vendor-managed cloud services, but client installations require manual updates.
Affected versions are: NetScaler ADC and Gateway 14.1 (prior to version 14.1-47.48), 13.1 (prior to version 13.1-59.22), as well as NetScaler ADC 13.1-FIPS/NDcPP (prior to version 13.1-37.241), and 12.1-FIPS/NDcPP (prior to version 12.1-55.330).
| CVE-ID | Description | Prerequisites | CWE | CVSS v4.0 |
|---|---|---|---|---|
| CVE-2025-7775 | Memory overflow leading to remote code execution and/or denial of service | NetScaler configured as a gateway (VPN virtual server, ICA proxy, CVPN, RDP proxy) or as an AAA virtual server OR NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS, and NDcPP: HTTP, SSL, or HTTP_QUIC LB virtual servers associated with IPv6 services or service groups that include IPv6 servers OR NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1 – FIPS and NDcPP – LB virtual servers of type HTTP, SSL, or HTTP_QUIC associated with IPv6 DBS services or groups that include IPv6 DBS servers OR CR – virtual server type HDX | CWE-119 – Incorrect limit for operations inside memory buffer | Base Rating: 9.2 |
| CVE-2025-7776 | Memory overflow leading to unpredictable or incorrect behavior and denial of service | NetScaler is configured as a gateway (VPN virtual server, ICA proxy, CVPN, RDP proxy) with an associated PCoIP profile | CWE-119 – Incorrect limit for operations within the memory buffer | Base Rating: 8.8 |
| CVE-2025-8424 | Invalid access control on the NetScaler management interface | Access to NSIP, cluster management IP, local GSLB site IP, or SNIP with management access enabled | CWE-284 – Incorrect access control | Base Rating: 8.7 |
Also, please note that versions 12.1 and 13.0 are no longer supported and should be migrated to the current releases. Updates are available for both standard gateways and on-prem and hybrid Secure Private Access deployments using NetScaler instances.
Citrix recommends updating to the following builds:
There are no workarounds.
Fixes have already been implemented for Citrix-managed clouds and Adaptive Authentication.
To evaluate their installation, administrators can check their configuration for the telltale strings listed in the bulletin. Citrix has notified customers and partners via the NetScaler support site. The issues are also confirmed in industry bulletins and vulnerability databases.
Redazione