Jump to the main content block
  1. Home
  2. 公告資訊_Vulnerability Alert

【Vulnerability Alert】Two Critical Security Vulnerabilities Found in Citrix NetScaler ADC and NetScaler Gateway (CVE-2025-7775 and CVE-2025-7776)

publish date : 2025-08-29 update date : 2025-08-29

Source: Ministry of education information & communication security contingency platform

Publication Number TACERT-ANA-2025082703080707 Publication Time 2025/08/27 15:42
Incident Type ANA-Vulnerability Alert Discovery Time 2025/08/27 15:42
Impact Level Low  
[Subject]
【Vulnerability Alert】Two Critical Security Vulnerabilities Found in Citrix NetScaler ADC and NetScaler Gateway (CVE-2025-7775 and CVE-2025-7776)
[Content]
Forwarded from TWCERTCC-200-202508-00000017

"Citrix’s NetScaler ADC (formerly known as Citrix ADC) is a network appliance designed to optimize, secure, and manage enterprise applications and cloud services; NetScaler Gateway (formerly known as Citrix Gateway) provides secure remote access solutions, enabling users to safely access applications and data from any location.

Citrix released a critical security vulnerability advisory (CVE-2025-7775, CVSS 4.x: 9.2 and CVE-2025-7776, CVSS 4.x: 8.8). CVE-2025-7775 is a memory overflow vulnerability that can lead to remote code execution or DoS attacks; CVE-2025-7776 is also a memory overflow vulnerability, causing unpredictable or erroneous behavior and DoS attacks. In addition, CVE-2025-7775 has already been observed being exploited by attackers. It is recommended to promptly adopt temporary mitigation measures to prevent potential attacks targeting this vulnerability.

Note: The affected products NetScaler ADC and NetScaler Gateway versions 12.1 and 13.0 are already End of Life (EoL). Citrix recommends upgrading to supported versions."

Information Sharing Level: WHITE (Information content can be publicly disclosed)
[Affected Platform]
● NetScaler ADC and NetScaler Gateway versions prior to 14.1-47.48 (not included)
● NetScaler ADC and NetScaler Gateway versions prior to 13.1-59.22 (not included)
● NetScaler ADC 13.1-FIPS and NDcPP versions prior to 13.1-37.241-FIPS and NDcPP (not included)
● NetScaler ADC 12.1-FIPS and NDcPP versions prior to 12.1-55.330-FIPS and NDcPP (not included)
[Recommended Actions]
Please update to the following versions:
● NetScaler ADC and NetScaler Gateway version 14.1-47.48 (inclusive) or later
● NetScaler ADC and NetScaler Gateway version 13.1-59.22 (inclusive) or later
● NetScaler ADC 13.1-FIPS and NDcPP version 13.1-37.241-FIPS and NDcPP (inclusive) or later
● NetScaler ADC 12.1-FIPS and NDcPP version 12.1-55.330-FIPS and NDcPP (inclusive) or later
[Reference]
https://www.twcert.org.tw/tw/cp-169-10345-94c2a-1.html
(This notification is for informational purposes only and does not constitute a cybersecurity incident).
If you have questions or suggestions regarding this notification, please feel free to contact us.
Ministry of education information & communication security contingency platform
Website: https://info.cert.tanet.edu.tw/
Phone: +886-7-5250211
Internet Phone: 98400000
E-Mail: service@cert.tanet.edu.tw
Organizer: Computer Center
Click Num:
Print