Over 28,000 Citrix Instances Vulnerable to Actively Exploited 0-Day RCE

A newly discovered zero-day remote code execution (RCE) vulnerability, CVE-2025-7775, is under active exploitation against Citrix Netscaler ADC and Gateway appliances worldwide.

With over 28,200 instances still unpatched as of August 26, 2025, according to Shadowserver Foundation data, this flaw poses an urgent threat to enterprise networks, especially in the United States and Germany.

Unauthenticated RCE Allows Full System Takeover

CVE-2025-7775 is an unauthenticated RCE vulnerability in Citrix’s NetScaler ADC and Gateway products.

Exploitation requires no credentials—an attacker can send a specially crafted HTTP request to a vulnerable appliance’s management interface, triggering arbitrary code execution in the context of nsroot.

The vulnerability resides in the request parsing logic of the NetScaler firmware:

c/* Simplified vulnerable code snippet */
int parse_http_request(request_t *req) {
    char buffer[1024];
    int len = req->content_length;
    if (len > sizeof(buffer)) {
        memcpy(buffer, req->body, len);
        // Missing bounds check leads to buffer overflow
    }
    handle_request(buffer);
}

Successful exploitation permits full control over the underlying operating system, enabling attackers to:

• Deploy ransomware or cryptominers
• Install persistent backdoors
• Exfiltrate sensitive data
• Pivot to internal networks

CISA has added CVE-2025-7775 to its Known Exploited Vulnerabilities (KEV) catalog, mandating U.S. Federal Civilian Executive Branch agencies apply the patch by a specified deadline.

Immediate Mitigation and Workarounds

Citrix released Security Bulletin CTX694938, providing firmware updates that patch the request-parsing flaw. Administrators are urged to:

1. Apply official patches for all affected NetScaler ADC and Gateway versions immediately.
2. Review server logs for indicators of compromise (IoCs), such as unexpected nsroot sessions or anomalous outbound connections.
3. Isolate vulnerable appliances from the internet until firmware updates can be applied.
4. Deploy WAF rules to block exploit payloads targeting the HTTP management interface.

For environments where immediate patching is not feasible, Citrix recommends disabling the Netscaler management interface on public networks and restricting access to trusted IP ranges only.

Additionally, organizations should monitor threat intelligence feeds for emerging IoCs and update intrusion detection systems accordingly.

The scale of this zero-day is unprecedented for Citrix products, with tens of thousands of servers at risk of full compromise.

Given the active exploitation in the wild and the potential for severe business disruption, applying the CTX694938 patch without delay is paramount for all organizations running NetScaler ADC or Gateway.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates