CVE-2025-7775: What Citrix NetScaler Customers Need to Do Now

TL;DR: Citrix/NetScaler disclosed a critical memory overflow in NetScaler ADC/Gateway (CVE-2025-7775) that is actively exploited. There are no mitigations - you must upgrade to fixed builds and hunt for signs of compromise on any instance meeting the vendor’s pre-conditions. 
‍

What’s the vulnerability? 

 
CVE-2025-7775 is a memory overflow that can lead to remote code execution (RCE) and/or DoS when NetScaler is configured as Gateway/AAA or under specific IPv6 load-balancing/CR (HDX) setups. Citrix confirmed exploitation on unpatched appliances and CISA added the bug to KEV. 

‍
As of this writing, no public PoC has been observed yet, but exploitation is ongoing, and we expect a publicly available PoC to drop soon - so treat this as a live-fire event. ‍

‍
Who's affected?

‍
You’re in scope if any NetScaler instance is: 

• A Gateway (VPN vserver, ICA Proxy, CVPN, RDP Proxy) or AAA vserver
• An HTTP/SSL/HTTP_QUIC LB vserver bound to IPv6 backends (incl. DBS IPv6)
• A CR vserver of type HDX.

‍

What to do (now)

‍

1. Identify scope - Use NetScaler Console/ADM → Security Advisory → CVE Detection to enumerate impacted instances; export the list and owners.
2. Patch immediately - Upgrade impacted instances to the fixed builds above. There are no vendor mitigations to safely delay patching.
   
3. Hunt for exploitation (even after patching):
   • Review appliance logs: httpaccess*.log, httpaccess-vpn.log, httperror*.log, auth.log, nsvpn.log, vpndebug.log, ns.log; parse newnslog with nsconmsg for anomalies.
   • Check common persistence paths seen in prior NetScaler campaigns: /var/netscaler/logon/LogonPoint/uiareas/, /netscaler/ns_gui/epa/scripts/, /var/vpn/themes/.
   • Inspect ns.conf for unexpected user/AAA/policy changes, key/cert bindings, or rewrite/responder rules.
4. If a compromise is suspected - Preserve evidence, isolate, then rotate secrets, reset user passwords that authenticate via the Gateway/AAA, and reissue TLS keys/certs stored on the device; rebuild from a clean image if persistence is suspected.

‍

How Tonic's Contextualized Exposure Management platform helps customers identify, prioritize, and resolve critical Citrix exposures.

‍

Tonic accelerates remediation by providing actionable context:

Business context — who and what actually matters

• Map every NetScaler/ADC to the applications and business processes it enables (e.g., Remote Access, Customer Portal, ERP).
• Surface owners and resolving groups with confidence (business + technical), plus BU, environment (prod/non-prod), and geography so you can route work and communicate impact immediately.
• Prioritize by business criticality: If a Gateway fronts payroll or trading, it jumps the queue.

‍

Operational context — the truth on the ground

• Enumerate all instances/HA pairs, their builds, and whether they’re internet-exposed; show version drift and CMDB vs. reality gaps.
• Highlight missing controls: no EDR on management hosts, no recent backup, or no scanner coverage on the appliance’s management plane.
• One-click triage with Findings in Focus: Combine “publicly exploited” + “internet-exposed” + “high-criticality apps” to bubble up the exact NetScaler assets that need action now.
• Push Jira/ServiceNow tickets pre-filled with owner, app, environment, and business impact; track SLA to closure.

‍

Adversarial context — likelihood, reach, and blast radius

• Fuse threat intel with reachability (external VIPs, segmentation context) to score exploitability, not just CVSS.
• Auto-pivot from an impacted NetScaler to its dependent apps, data stores, and identities to see the business blast radius if compromise is confirmed.
• Drop in our hunt checklist directly from the advisory and attach log queries; pull results back into the case so detections and findings live with the asset/app record.

‍

‍

How our customers are already leveraging Tonic to respond to Citrix CVEs:

“We started with a pile of ‘Citrix’ assets. In Tonic we ended with: 4 internet-facing Gateways tied to ‘Remote Work’ and ‘Customer Portal,’ owned by X and Y; 1 HA pair still on a vulnerable build; 1 site missing EDR on the management host; 2 apps tagged ‘Critical’. Tickets opened to the right teams with context, and remediation tracked to done.”

‍

If you’re on Tonic today: open Applications → search “Citrix” (or “NetScaler”), hit Findings in Focus, and assign the owners you see. If you’re not, we can run a rapid discovery across your CMDB, scanners, and collaboration tools to produce the same prioritized list in hours.

‍

‍

‍