CVE-2025-7775

What it actually does

CVE-2025-7775 is a memory overflow in Citrix NetScaler ADC and NetScaler Gateway that can be reached remotely when specific virtual server configurations are exposed. Affected configurations include Gateway functions such as VPN virtual server, ICA Proxy, CVPN, and RDP Proxy; AAA virtual servers; certain HTTP, SSL, or HTTP_QUIC load-balancing virtual servers using IPv6 services, service groups, or DBS IPv6 backends; and CR virtual servers of type HDX. Successful exploitation can corrupt process memory and may allow unauthenticated remote code execution in the appliance data plane and/or cause denial of service through process crashes or appliance instability.

Why it matters to the business

Because NetScaler ADC and Gateway commonly sit at the internet edge and provide remote access, application delivery, authentication, and ICA/HDX access, exploitation can disrupt workforce access, expose internal applications, and provide attackers with a foothold near sensitive authentication and traffic flows. The vulnerability is listed in CISA KEV, has observed in-the-wild exploitation, and carries a CISA remediation deadline of 2025-08-28, so exposed systems should be treated as urgent even where no outage has been observed. Operational consequences can include VPN or application outages, compromise of edge infrastructure, credential/session exposure risk, incident response costs, and emergency change activity across widely deployed Citrix remote-access estates.

How an attack unfolds

An attacker first identifies an internet-facing NetScaler ADC or Gateway and determines whether it exposes a vulnerable Gateway, AAA, IPv6-backed load-balancing, DBS IPv6-backed load-balancing, or HDX CR virtual server configuration. The attacker then sends specially crafted network traffic to the vulnerable virtual server to trigger the memory overflow. Depending on appliance version, configuration, memory layout, and exploit reliability, the result may be a crash and denial of service or attacker-controlled code execution in a NetScaler process. If code execution is achieved, the attacker may attempt to run commands, establish persistence, alter configuration, stage tools, capture credentials or session material, pivot through published access paths, or suppress logs. Public threat intelligence marks exploitation as active in the wild and associates tracking activity with Citrix NetScaler memory-overflow exploitation; any references to RomCom-related reporting should be validated against local telemetry before attribution is assumed.

How to fix it

Upgrade affected NetScaler ADC and NetScaler Gateway appliances to a vendor-supported fixed build for the deployed release train. Because no exact fixed versions were provided in the input, use the current Citrix security bulletin for CVE-2025-7775 to identify the corrected builds for NetScaler ADC/Gateway 13.1, 14.1, 13.1-FIPS, and NDcPP variants, then prioritize externally reachable Gateway, AAA, IPv6-backed load-balancing, DBS IPv6-backed load-balancing, and HDX CR configurations. If immediate upgrade is not possible, reduce exposure by disabling or restricting vulnerable virtual servers, removing unnecessary IPv6 service/servicegroup bindings, limiting management and service access to trusted networks, placing additional network filtering in front of exposed services, and disabling unused Gateway features such as CVPN, RDP Proxy, ICA Proxy, or AAA where operationally feasible. Mitigation should be considered temporary; patching remains the primary corrective action for a memory-corruption RCE/DoS flaw.

How to confirm the fix worked

Confirm remediation by verifying the running NetScaler build against Citrix’s fixed-version matrix for the relevant release train and appliance type. Enumerate configured virtual servers and confirm whether any Gateway, AAA, HTTP/SSL/HTTP_QUIC load-balancing with IPv6 services/service groups or DBS IPv6 backends, or HDX CR virtual servers remain exposed on vulnerable builds. Validate that upgraded appliances have fully rebooted into the corrected build and that high-availability pairs, cluster nodes, FIPS/NDcPP appliances, and standby devices were also updated. Review external attack surface scans to ensure no vulnerable services remain reachable. After patching, monitor for continued nsppe crashes, unexpected reboots, abnormal Gateway/AAA traffic, and configuration drift that could indicate either failed remediation or prior compromise.

Typical attack path

1. Scan the internet for NetScaler ADC or NetScaler Gateway appliances exposing Gateway, AAA, HTTP/SSL/HTTP_QUIC load-balancing, or HDX services.
2. Fingerprint appliance behavior, exposed virtual servers, TLS certificates, HTTP headers, Gateway portals, or Citrix-specific response patterns.
3. Send crafted requests or protocol traffic to a vulnerable virtual server to trigger the memory overflow.
4. Cause NetScaler process instability, crash, or controlled memory corruption.
5. If exploitation yields code execution, execute commands or payloads on the appliance.
6. Attempt post-exploitation actions such as configuration discovery, credential/session theft, persistence, log tampering, or pivoting to internal applications reachable through the appliance.
7. Use the compromised edge device for continued access, traffic interception, or further intrusion activity.

How to detect it

To determine whether exploitation already occurred, collect and review NetScaler appliance logs, crash artifacts, configuration history, authentication logs, shell history, and network telemetry covering the period before remediation. Key sources include /var/log/ns.log, /var/nslog/newnslog, /var/log/httpaccess.log, /var/log/httperror.log, /var/log/aaad.debug where enabled, /var/core/ and other crash/core locations, saved ns.conf versions, admin audit logs, and upstream firewall/WAF/load-balancer logs. Look for nsppe or packet-engine crashes, signal 11/segmentation-fault events, repeated appliance restarts, anomalous requests to Gateway/AAA/LB/HDX virtual servers, high-volume malformed traffic, unusual IPv6-targeted traffic to affected LB configurations, unexpected command execution, new or modified local users, cron jobs, rc scripts, web-accessible files, changed NetScaler configuration, and gaps or truncation in logs. Because active exploitation is reported, absence of a known public payload string should not be treated as proof of safety; correlate crash timing with external source IPs, authentication anomalies, and configuration changes. If compromise is suspected, acquire forensic images or vendor-supported tech support bundles before rebuilding, and compare file integrity and configuration against a known-good baseline.

• /var/log/ns.log
• /var/nslog/newnslog
• /var/log/httpaccess.log
• /var/log/httperror.log
• /var/log/aaad.debug
• /var/core/
• /var/crash/
• /nsconfig/ns.conf
• /nsconfig/rc.netscaler
• /var/spool/cron/crontabs/
• nsppe
• segmentation fault
• Signal 11
• core dumped
• kill -11
• rebooted due to software failure
• nsconmsg
• HTTP_QUIC
• ICA Proxy
• RDP Proxy
• CVPN
• AAA vserver
• HDX

What your security team should do

• Treat all internet-facing affected NetScaler ADC and Gateway appliances as emergency-priority assets because the vulnerability is KEV-listed and exploited in the wild.
• Patch or otherwise remove exposure before the CISA KEV due date of 2025-08-28 if still applicable to compliance obligations; if overdue, escalate as an active risk exception until remediated.
• Inventory all NetScaler virtual servers and specifically identify Gateway, AAA, IPv6-backed LB, DBS IPv6-backed LB, and HDX CR configurations.
• Prioritize forensic review of appliances that were internet-facing before patching, especially those showing nsppe crashes, core dumps, reboots, configuration changes, or unusual authentication activity.
• Preserve relevant logs, core files, configuration snapshots, and network telemetry before rebooting or rebuilding appliances where compromise is suspected.
• Rotate credentials, API keys, and administrative secrets that may have traversed or been stored on appliances if signs of compromise are found.
• Restrict appliance management interfaces and service exposure to trusted networks and enforce MFA for remote-access workflows where supported.
• Add monitoring for NetScaler process crashes, unexpected shell activity, suspicious file creation, and configuration changes until all appliances are patched and validated.