CVE-2025-7775

Citrix NetScaler Memory Overflow Vulnerability

Citrix NetScalerNetwork & edge

CVSS

9.2Critical

ExploitationExploited in the wildAdded to KEV 26 Aug 2025CISA KEV

Exploit odds (EPSS)20.3%Chance of exploitation activity in the next 30 days, higher than 97% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed in47.48Also 59.22, 37.241 and 1 moreCVE List

Federal deadline28 Aug 2025Remediation due date for US federal agenciesCISA KEV

CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

47.48ADCCVE List
59.22ADCCVE List
37.241ADCCVE List
55.330ADCCVE List
47.48GatewayCVE List
59.22GatewayCVE List

Show all 8 fixed versions

37.241GatewayCVE List
55.330GatewayCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

26 Aug 2025Added to CISA KEVCISA KEV
26 Aug 2025, 12:56 UTCPublishedCVE List

Description

Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service.

Text from CVE List

Affected versions 8

ADCaffected: 14.1 before 47.48CVE List
ADCaffected: 13.1 before 59.22CVE List
ADCaffected: 13.1 FIPS and NDcPP before 37.241CVE List
ADCaffected: 12.1 FIPS and NDcPP before 55.330CVE List
Gatewayaffected: 14.1 before 47.48CVE List
Gatewayaffected: 13.1 before 59.22CVE List
Gatewayaffected: 13.1 FIPS and NDcPP before 37.241CVE List
Gatewayaffected: 12.1 FIPS and NDcPP before 55.330CVE List