DaystoPatch

CitrixExploited incident

NetScaler ADC and Gateway memory overflow RCE exploited at disclosure (August 2025)

CVE-2025-7775, CVE-2025-7776, CVE-2025-8424Critical, CVSS 9.2In CISA's Known Exploited Vulnerabilities catalog since 26 Aug 2025

  • Exploited before a fix
FixedFixed for every supported version on the day it became public.
Embed this live clock

Response

Silence
0h
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    CVE record CVE-2025-7775 (CNA: NetScaler)CuratedQuote verified

    "datePublished":"2025-08-26T12:56:53.794Z"

    Citrix's own disclosure, which already said exploits had been observed, is the earliest public signal found.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c7cfb463ae64c740…
    Used in metrics
    Yes
    Dispute this timestamp
    6 more sources for this moment
    Citrix advisory CTX694938ClaimedQuote verified26 Aug 2025

    NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2025-7775, CVE-2025-7776 and CVE-2025-8424

    The vendor's own disclosure.

    Source
    Citrix advisory CTX694938 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:23f4f8898b2ecb32…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-7775)ClaimedQuote verified26 Aug 2025

    Citrix NetScaler Memory Overflow Vulnerability

    Added to CISA's KEV catalog on 2025-08-26.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Citrix bulletin CTX694938CuratedQuote verified26 Aug 2025

    Exploits of CVE-2025-7775 on unmitigated appliances have been observed.

    Source
    Citrix bulletin CTX694938 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:23f4f8898b2ecb32…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-7775ClaimedQuote verified26 Aug 2025, 12:56 UTC

    Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy,

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c7cfb463ae64c740…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet26 Aug 2025, 13:13 UTC

    You can now share your thoughts on vulnerability CVE-2025-7775 in Vulnerability-Lookup:

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet26 Aug 2025, 22:19 UTC

    system at risk? Read on to find out what you can do now. https:// thedefendopsdiaries.com/unders tanding-and-mitigating-the-cve-2025-7775-vulnerability-in-citrix-netscaler/ # cve20257775 # citrix # netscaler # rce # cybersecurity

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    CVE record CVE-2025-7775 (CNA: NetScaler)CuratedQuote verified

    "datePublished":"2025-08-26T12:56:53.794Z"

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c7cfb463ae64c740…
    Used in metrics
    Yes
    Dispute this timestamp
    2 more sources for this moment
    Citrix advisory CTX694938ClaimedQuote verified26 Aug 2025

    NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2025-7775, CVE-2025-7776 and CVE-2025-8424

    Source
    Citrix advisory CTX694938 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:23f4f8898b2ecb32…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Citrix bulletin CTX694938CuratedQuote verified26 Aug 2025

    2025-08-26 Initial Publication

    Source
    Citrix bulletin CTX694938 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:23f4f8898b2ecb32…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Citrix bulletin CTX694938CuratedQuote verified

    NetScaler ADC and NetScaler Gateway 14.1-47.48 and later releases

    Bulletin has a single changelog entry (initial publication 2025-08-26), so the fixed builds were listed from the start.

    Source
    Citrix bulletin CTX694938 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:23f4f8898b2ecb32…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Citrix bulletin CTX694938CuratedQuote verified

    NetScaler ADC 12.1-FIPS and 12.1-NDcPP 12.1-55.330 and later releases of 12.1-FIPS and 12.1-NDcPP

    Fixes for 14.1, 13.1, 13.1-FIPS/NDcPP and 12.1-FIPS/NDcPP at publication. Non-FIPS 12.1 and 13.0 are end of life and not counted.

    Source
    Citrix bulletin CTX694938 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:23f4f8898b2ecb32…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

NetScaler zero-day memory overflow exploited; fixes released Aug 26, 2025

Attackers were exploiting a NetScaler memory overflow that can lead to remote code execution when Citrix released fixes on 26 August 2025.

In plain words

Citrix NetScaler, a common internet-facing remote access gateway, had a critical flaw that attackers were already using when Citrix released fixes on 26 August 2025. If we run NetScaler ourselves, it must be on a fixed version, and since several more NetScaler flaws were fixed in 2026, the latest build is the safe choice.

What happened and who is affected

What happened

On 26 August 2025 Citrix published bulletin CTX694938 for CVE-2025-7775, a memory overflow in NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service, together with two less severe flaws. Citrix said exploits had already been observed on unmitigated appliances. Fixed builds for all supported branches were released the same day.

Who is affected

Customer-managed NetScaler ADC and Gateway 14.1 before 14.1-47.48, 13.1 before 13.1-59.22, 13.1-FIPS/NDcPP before 13.1-37.241 and 12.1-FIPS/NDcPP before 12.1-55.330, when configured as a Gateway or AAA virtual server or with certain load-balancing configurations. 12.1 and 13.0 are end of life.

CVE-2025-7775, CVE-2025-7776, CVE-2025-8424. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/citrix-cve-2025-7775/

Affected products

  • NetScaler ADC
  • NetScaler Gateway
  • NetScaler ADC FIPS and NDcPP
How we built this timeline

Zero-day acknowledged in the initial bulletin with fixes the same day. Bulletin also fixes CVE-2025-7776 (memory overflow, CVSS 8.8) and CVE-2025-8424 (improper access control on the management interface, CVSS 8.7); only CVE-2025-7775 is in KEV.

CVSS 9.2 (v4.0) for CVE-2025-7775. No earlier public exploitation report was found.

Bulletin change log has one entry; Wayback copies were not compared (Wayback offline intermittently during research).

Related

Citrix report card