Citrix fixes critical NetScaler RCE flaw exploited in zero-day attacks

Citrix fixed three NetScaler ADC and NetScaler Gateway flaws today, including a critical remote code execution flaw tracked as CVE-2025-7775 that was actively exploited in attacks as a zero-day vulnerability. The CVE-2025-7775 flaw is a memory overflow bug that can lead to unauthenticated, remote code execution on vulnerable devices. In an advisory released today, Citrix states that this flaw was observed being exploited in attacks on unpatched devices. "As of August 26, 2025 Cloud Software Group has reason to believe that exploits of CVE-2025-7775 on unmitigated appliances have been observed, and strongly recommends customers to upgrade their NetScaler firmware to the versions containing the fix as there are no mitigations available to protect against a potential exploit.," reads a blog post about the flaw. While Citrix has not shared indicators of compromise or any other information that could be used to determine if devices were exploited, they did share that devices must be configured in one of the following configurations to be vulnerable: In an advisory released today, Citrix shared configuration settings that can be checked to determine if your NetScaler device is using one of the above configurations. BleepingComputer contacted Citrix and Cloud Software Group with questions about the exploitation of CVE-2025-7775 and will update our story if we receive a reply. In addition to the RCE flaw, today's update also addresses a memory overflow vulnerability that could lead ...