UpHeron
All vulnerabilities

Servers and applications

CVE-2025-7775

Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or…

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 26 Aug 2025.

Severity
Critical 9.2
Published
26 Aug 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
12.1-55.330, 13.1-37.241, 13.1-59.22, 14.1-47.48
Sources
NVD

Affected software

SoftwareAffected versions
NetScaler ADC and GatewayServers and applications · cpe:a:citrix:netscaler_application_delivery_controller
  • From 12.1 before 12.1-55.330
  • From 13.1 before 13.1-37.241
  • From 13.1 before 13.1-59.22
  • From 14.1 before 14.1-47.48
NetScaler ADC and GatewayServers and applications · cpe:a:citrix:netscaler_gateway
  • From 13.1 before 13.1-59.22
  • From 14.1 before 14.1-47.48

Known exploited

CISA name
Citrix NetScaler Memory Overflow Vulnerability
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due for US agencies
28 Aug 2025
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-7775
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-7775