{"slug":"citrix-netscaler","title":"Citrix NetScaler RCE (CVE-2025-7775)","shortName":"Citrix NetScaler","summary":"Unauthenticated memory-overflow remote code execution and/or denial of service in NetScaler ADC and Gateway when Gateway, AAA, certain IPv6 load-balancing, or HDX cache-redirection is in use. NVD CVSS 3.1 9.8. Citrix observed exploitation on unmitigated appliances. CISA KEV 26 Aug 2025.","isExample":false,"draft":false,"family":"citrix-netscaler","kind":"single-product","aliases":["CVE-2025-7775","NetScaler ADC","NetScaler Gateway","CitrixDeelb"],"publishedAt":"2025-08-26","updatedAt":"2026-10-24","patchStatus":"patched","exploited":true,"scores":{"cve":"CVE-2025-7775","cvss":{"cve":"CVE-2025-7775","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"nvd","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-7775","sourceDate":"2026-06-17","checkedDate":"2026-10-24"},"epss":{"cve":"CVE-2025-7775","score":0.20284,"percentile":0.97472,"date":"2026-10-23","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-7775","checkedDate":"2026-10-24"},"kev":{"cve":"CVE-2025-7775","listed":true,"dateAdded":"2025-08-26","dueDate":"2025-08-28","catalogVersion":"2026.10.23","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-24"},"addedDate":"2026-10-24"},"priority":{"label":"act-now"},"managementSummary":{"what":"Unauthenticated memory-overflow remote code execution and/or denial of service in NetScaler ADC and Gateway (CVE-2025-7775). NVD CVSS 9.8. Citrix observed exploitation on unmitigated appliances. Listed in CISA KEV on 26 Aug 2025.","action":"Install a CTX694938 fixed build, confirm a listed precondition is present, and hunt for webshells that can survive the upgrade."},"seenInTheWild":[{"metric":"exploitation-confirmed","value":"Exploits observed on unmitigated appliances","observer":"Citrix","date":"2025-08-26","method":"Vendor statement in CTX694938","sourceUrl":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938"},{"metric":"exploitation-confirmed","value":"Listed","observer":"CISA","date":"2025-08-26","method":"CISA Known Exploited Vulnerabilities catalog dateAdded","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"metric":"exposed","value":"more than 28,000 unpatched instances","observer":"Shadowserver","date":"2025-08-27","method":"Exposure count reported via Cybersecurity Dive (published 27 Aug 2025). Not confirmed compromise.","sourceUrl":"https://www.cybersecuritydive.com/news/citrix-netscaler-zero-day-active-exploitation/758738/"}],"seenInTheWildLinks":[{"title":"Shadowserver dashboard","url":"https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=7&source=http_vulnerable&source=http_vulnerable6&tag=cve-2025-7775%2B&dataset=unique_ips&style=stacked","observer":"Shadowserver","metric":"possibly-vulnerable"}],"whatChanged":{"date":"2026-10-24","items":[{"text":"Page added","section":"overview"},{"text":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected"},{"text":"Act-now priority block with sourced CVSS, EPSS, and CISA KEV dates.","section":"priority","addedDate":"2026-10-24"},{"text":"Detection rule coverage table and JSON, IOC CSV, and STIX feeds.","section":"detection","addedDate":"2026-10-24"}]},"whatTheBugIs":"CVE-2025-7775 is a memory overflow in NetScaler ADC and NetScaler Gateway that can lead to remote code execution and/or denial of service. Citrix rates it CVSS 4.0 9.2. NVD rates CVSS 3.1 9.8. Citrix CTX694938 (26 Aug 2025) says exploits on unmitigated appliances have been observed. There is no workaround. The only vendor remediation is to install a fixed build.\n\nPreconditions (any one, per Citrix): a Gateway virtual server (VPN, ICA Proxy, CVPN, or RDP Proxy); or an AAA virtual server; or, on 13.1, 14.1, FIPS, or NDcPP, an HTTP, SSL, or HTTP_QUIC load-balancing virtual server bound to IPv6 or DBS IPv6 services; or a cache-redirection virtual server of type HDX. Citrix publishes the matching ns.conf strings in CTX694938 (add vpn vserver, add authentication vserver, and related bindings).\n\nFixed builds start at 14.1-47.48, 13.1-59.22, 13.1-FIPS/NDcPP 13.1-37.241, and 12.1-FIPS/NDcPP 12.1-55.330. General 12.1 and 13.0 trains are end of life and must move to a supported fixed train. CTX694938 applies to customer-managed appliances; Cloud Software Group upgrades Citrix-managed cloud services and Citrix-managed Adaptive Authentication.\n\nIndependent reporting describes pre-authentication code execution used to drop webshells (Kevin Beaumont, via Infosecurity Magazine) and backdoors that can survive a patch (Jimi Sebree / Horizon3.ai, via Cybersecurity Dive). Tenable and Arctic Wolf reported no public proof of concept at disclosure. Treat simulated GitHub repositories as non-exploits. CTX694938 also lists CVE-2025-7776 and CVE-2025-8424 as co-disclosed siblings; this page is only about the CVE-2025-7775 code-execution path.","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"reach","label":"Edge reachability","detail":"Unauthenticated network access to an affected NetScaler ADC or Gateway that meets a listed precondition."},{"id":"unsafe","label":"Memory overflow","detail":"A crafted request triggers a memory overflow (CWE-119) in request handling."},{"id":"exec","label":"Code exec or DoS","detail":"Vendor impact class: remote code execution and/or denial of service. Conceptual only."},{"id":"persist","label":"Webshell / backdoor","detail":"Public reporting describes webshells and persistence that can remain after a patch. Hunt before trusting the upgrade."}]},"exploitation":{"kev":{"listed":true,"date":"2025-08-26","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CISA KEV CVE-2025-7775 Citrix NetScaler Memory Overflow Vulnerability. dateAdded 2025-08-26, due 2025-08-28. knownRansomwareCampaignUse Unknown. catalogVersion checked 2026.10.23."},"firstSeen":{"date":"2025-08-26","source":"Citrix / Cloud Software Group","note":"Vendor states exploits on unmitigated appliances have been observed as of the 26 Aug 2025 advisory. Independent reporters state activity began before patches were available. Exact first calendar day is not established in the primary sources reviewed."},"vendorStatements":[{"vendor":"Citrix (Cloud Software Group)","date":"2025-08-26","statement":"Exploits of CVE-2025-7775 on unmitigated appliances have been observed. Cloud Software Group strongly urges affected customers to install the relevant updated versions as soon as possible. Workarounds/Mitigating Factors: None.","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938","retracted":false},{"vendor":"NetScaler","date":"2025-08-26","statement":"As of 26 Aug 2025 Cloud Software Group has reason to believe that exploits of CVE-2025-7775 have been observed.","url":"https://www.netscaler.com/blogs/2025-08/critical-security-update-announced-for-netscaler-gateway-and-netscaler","retracted":false}]},"timeline":[{"date":"2025-08-26","event":"Citrix publishes CTX694938. The bulletin says exploits of CVE-2025-7775 on unmitigated appliances have been observed and lists no workaround.","source":{"title":"CTX694938 Security Bulletin","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938","publisher":"Citrix"},"kind":"advisory","key":true,"addedDate":"2026-10-24"},{"date":"2025-08-26","event":"NetScaler blog restates the in-the-wild note and the fixed builds.","source":{"title":"Critical security update announced for NetScaler","url":"https://www.netscaler.com/blogs/2025-08/critical-security-update-announced-for-netscaler-gateway-and-netscaler","publisher":"NetScaler"},"kind":"vendor","addedDate":"2026-10-24"},{"date":"2025-08-26","event":"CISA adds CVE-2025-7775 to KEV (due 28 Aug 2025). knownRansomwareCampaignUse Unknown.","source":{"title":"CISA KEV catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"kev","key":true,"addedDate":"2026-10-24"},{"date":"2025-08-27","event":"Infosecurity Magazine reports Kevin Beaumont describing pre-authentication code execution used to drop webshells, with campaigns before patches.","source":{"title":"Citrix Issues Emergency Patch for Actively Exploited NetScaler Zero-Days","url":"https://www.infosecurity-magazine.com/news/citrix-patch-netscaler-zero-days/","publisher":"Infosecurity Magazine"},"kind":"exploited","key":true,"addedDate":"2026-10-24"},{"date":"2025-08-27","event":"Cybersecurity Dive quotes Horizon3.ai that active exploitation is creating backdoors that can persist after patches, and reports a Shadowserver exposure count of more than 28,000 unpatched instances.","source":{"title":"Citrix NetScaler zero-day under active exploitation","url":"https://www.cybersecuritydive.com/news/citrix-netscaler-zero-day-active-exploitation/758738/","publisher":"Cybersecurity Dive"},"kind":"exploited","key":true,"addedDate":"2026-10-24"},{"date":"2025-09-08","event":"Nextron publishes agentless THOR hunting guidance for webshell-class artefacts and says patching is not enough.","source":{"title":"CVE-2025-7775 Citrix NetScaler detection with THOR","url":"https://www.nextron-systems.com/2025/09/08/cve-2025-7775-citrix-netscaler-detection-with-thor/","publisher":"Nextron"},"kind":"other","key":true,"addedDate":"2026-10-24"}],"openNotes":[{"title":"First calendar day before 26 Aug 2025 is not pinned","detail":"Citrix says exploits have been observed as of the advisory. Beaumont, via Infosecurity Magazine, says campaigns began before patches. No primary source reviewed here stamps an earlier first day.","sources":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938","date":"2025-08-26","publisher":"Citrix"},{"url":"https://www.infosecurity-magazine.com/news/citrix-patch-netscaler-zero-days/","date":"2025-08-27","publisher":"Infosecurity Magazine"}]},{"title":"No verified public weaponised proof of concept","detail":"Tenable and Arctic Wolf reported no public PoC at disclosure. Repositories that label themselves as simulations are not exploits against NetScaler.","sources":[{"url":"https://www.tenable.com/blog/cve-2025-7775-citrix-netscaler-adc-and-netscaler-gateway-zero-day-remote-code-execution","date":"2025-08-26","publisher":"Tenable"},{"url":"https://arcticwolf.com/resources/blog/cve-2025-7775/","date":"2025-08-26","publisher":"Arctic Wolf"}]}],"defenderActions":[{"title":"Upgrade to a fixed NetScaler build","detail":"Install 14.1-47.48 or later, 13.1-59.22 or later, 13.1-FIPS/NDcPP 13.1-37.241 or later, or 12.1-FIPS/NDcPP 12.1-55.330 or later. End-of-life 12.1 and 13.0 general trains must move to a supported fixed train. Citrix lists no workaround.","priority":"now","links":[{"label":"CTX694938","href":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938"}]},{"title":"Confirm whether the appliance meets a precondition","detail":"Inspect ns.conf for Gateway or AAA (add vpn vserver, add authentication vserver), IPv6 or DBS IPv6 load-balancing bindings, or HDX cache-redirection virtual servers, using the strings in CTX694938.","priority":"now"},{"title":"Compromise-assess even after patching","detail":"Assume webshells or backdoors may survive the upgrade. Run NCSC-NL citrix-2025 check scripts and/or an agentless YARA/IOC scan. Review httperror, VPN access, and shell logs.","priority":"now","links":[{"label":"NCSC-NL citrix-2025","href":"https://github.com/NCSC-NL/citrix-2025"},{"label":"Nextron THOR guidance","href":"https://www.nextron-systems.com/2025/09/08/cve-2025-7775-citrix-netscaler-detection-with-thor/"}]},{"title":"Reuse CISA AA23-201A hunting patterns","detail":"CVE-2023-3519 detection steps (new PHP under logon and vpn paths, httperror anomalies, unexpected shell history) remain a practical baseline for NetScaler webshell hunts.","priority":"soon","links":[{"label":"CISA AA23-201A","href":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a"}]}],"detection":[{"title":"NCSC-NL appliance check script hits","detail":"NCSC-NL scripts flag suspicious PHP/XHTML and other indicators on live NetScaler hosts. Treat non-low-confidence hits as compromise leads. The scripts were written for the 2025 Citrix wave and are not CVE-2025-7775-specific.","logSource":"Appliance filesystem / script log under /var/log/custom_checks_*","kind":"generic"},{"title":"New or unexpected PHP under logon and vpn paths","detail":"Borrowed from CISA AA23-201A: hunt *.php newer than the last known-good install under /var/netscaler/logon/, /var/vpn/, /netscaler/ns_gui/, and /var/python/.","logSource":"Appliance filesystem","kind":"generic"},{"title":"HTTP error and VPN access anomalies","detail":"From CISA AA23-201A: search httperror logs for unexpected .php or .sh; review httpaccess-vpn for 200s to unknown resources; watch shell history for ldapsearch, openssl, and keys paths.","logSource":"httperror.log* / httpaccess-vpn.log* / sh.log* / bash.log*","kind":"generic","group":"web-proxy"},{"title":"No public Sigma or Splunk detection file located","detail":"A 24 Oct 2026 check of SigmaHQ/sigma emerging-threats listings and splunk/security_content found no detection file for CVE-2025-7775. Use the pointers above and the NCSC-NL scripts.","logSource":"Public rule repositories","kind":"generic"}],"detectionRules":[],"detectionLinks":[{"title":"CTX694938 Security Bulletin (preconditions and fixed builds)","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938","author":"Citrix","date":"2025-08-26"},{"title":"Nextron: CVE-2025-7775 detection with THOR","url":"https://www.nextron-systems.com/2025/09/08/cve-2025-7775-citrix-netscaler-detection-with-thor/","author":"Nextron","date":"2025-09-08"},{"title":"CISA AA23-201A (transferable NetScaler webshell hunting)","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a","author":"CISA","date":"2023-07-20","note":"Written for CVE-2023-3519. Paths and log names remain a hunting baseline."},{"title":"NCSC-NL Citrix 2025 check scripts","url":"https://github.com/NCSC-NL/citrix-2025","author":"NCSC-NL","date":"2025-07-22"}],"retrohunt":{"summary":"Collect appliance filesystem and httperror, VPN access, and shell logs back to at least 26 Aug 2025. Hunt for unexpected PHP under logon and vpn paths, then run NCSC-NL or agentless YARA checks even on patched boxes.","lookback":{"from":"2025-08-26","basis":"first-exploitation","rationale":"Citrix acknowledged observed exploitation on 26 Aug 2025. Independent reporting says campaigns began before patches. If the appliance was internet-exposed on a vulnerable build, extend the window as far as retention allows. Webshells may persist after a patch.","sources":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938","date":"2025-08-26","publisher":"Citrix"},{"url":"https://www.infosecurity-magazine.com/news/citrix-patch-netscaler-zero-days/","date":"2025-08-27","publisher":"Infosecurity Magazine"}]},"logSources":[{"name":"Appliance filesystem (SSH or forensic image)","why":"Holds unexpected PHP/XHTML under logon, vpn, ns_gui, and python paths.","required":true},{"name":"httperror.log* and httpaccess-vpn.log*","why":"CISA AA23-201A uses these for unexpected .php/.sh and unknown 200s.","required":true},{"name":"sh.log* / bash.log*","why":"Shell history on the appliance after a successful drop.","required":false},{"name":"NCSC-NL script output under /var/log/custom_checks_*","why":"Records live-host check hits.","required":false}],"steps":[{"title":"Collect logs and a filesystem view before trusting the upgrade","detail":"Horizon3.ai, Nextron, and the NCSC-NL pattern from the 2025 Citrix wave all say patching is not enough if a backdoor is already present.","sources":[{"url":"https://www.cybersecuritydive.com/news/citrix-netscaler-zero-day-active-exploitation/758738/","date":"2025-08-27","publisher":"Cybersecurity Dive"},{"url":"https://www.nextron-systems.com/2025/09/08/cve-2025-7775-citrix-netscaler-detection-with-thor/","date":"2025-09-08","publisher":"Nextron"}]},{"title":"Hunt new PHP under logon and vpn paths","detail":"CISA AA23-201A (written for CVE-2023-3519) documents find for new .php under /netscaler/ns_gui/, /var/vpn/, /var/netscaler/logon/, and /var/python/.","sources":[{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a","date":"2023-07-20","publisher":"CISA"}]},{"title":"Search httperror and VPN access logs","detail":"CISA documents zgrep of httperror for .sh/.php and review of httpaccess-vpn.log* plus sh.log* / bash.log*.","sources":[{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a","date":"2023-07-20","publisher":"CISA"}]},{"title":"Run NCSC-NL or agentless YARA checks","detail":"NCSC-NL citrix-2025 scripts look for suspicious PHP/XHTML on the appliance. Nextron describes agentless THOR scanning of the filesystem.","sources":[{"url":"https://github.com/NCSC-NL/citrix-2025","date":"2025-07-22","publisher":"NCSC-NL"},{"url":"https://www.nextron-systems.com/2025/09/08/cve-2025-7775-citrix-netscaler-detection-with-thor/","date":"2025-09-08","publisher":"Nextron"}]}],"queries":[{"id":"v2s-rh-spl-netscaler-httperror","title":"NetScaler httperror / VPN access hits for unexpected PHP or shell","language":"spl","query":"index=* earliest=\"08/26/2025:00:00:00\" (source=\"*httperror*\" OR source=\"*httpaccess-vpn*\" OR source=\"*sh.log*\" OR source=\"*bash.log*\")\n(\".php\" OR \".sh\")\n| stats count min(_time) as firstTime max(_time) as lastTime values(source) as sources by host\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Forwarded httperror.log* / httpaccess-vpn.log* / sh.log* / bash.log*","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a","sourceDate":"2023-07-20","license":"CC0 1.0","origin":"vuln2shell","notes":"Patterns from CISA AA23-201A. Confirm the source field your collector uses for appliance logs.","tested":"untested","timeRange":"From 2025-08-26, limited by retention"},{"id":"v2s-rh-kql-netscaler-httperror","title":"NetScaler httperror / VPN access hits for unexpected PHP or shell","language":"kql","query":"Syslog\n| where TimeGenerated >= datetime(2025-08-26)\n| where SyslogMessage has_any (\".php\", \".sh\")\n| where SyslogMessage has_any (\"httperror\", \"httpaccess-vpn\", \"ns_gui\", \"netscaler\") or ProcessName has_any (\"httperror\", \"vpn\")\n| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Samples = make_set(SyslogMessage, 5) by Computer","logSource":"Forwarded NetScaler logs in Microsoft Sentinel (Syslog table)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a","sourceDate":"2023-07-20","license":"CC0 1.0","origin":"vuln2shell","notes":"Tune ProcessName/SyslogMessage to match how you ingest appliance logs.","tested":"untested","timeRange":"From 2025-08-26, limited by retention"},{"id":"v2s-rh-logscale-netscaler-httperror","title":"NetScaler httperror / VPN access hits","language":"logscale","query":"// Set the time picker to start 2025-08-26\n/(\\.php|\\.sh)/\n| /httperror|httpaccess-vpn|ns_gui|netscaler/\n| groupBy([#host], function=[count(), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)])","logSource":"Forwarded httperror / VPN access logs in LogScale","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a","sourceDate":"2023-07-20","license":"CC0 1.0","origin":"vuln2shell","tested":"untested","timeRange":"From 2025-08-26"}],"thirdPartyQueries":[{"title":"CISA AA23-201A NetScaler webshell hunting appendix","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a","author":"CISA","date":"2023-07-20","language":"guide","license":"public","origin":"vendor","note":"find and zgrep steps written for CVE-2023-3519. Still a practical baseline."},{"title":"NCSC-NL citrix-2025 live-host check scripts","url":"https://github.com/NCSC-NL/citrix-2025","author":"NCSC-NL","date":"2025-07-22","language":"guide","license":"see source","origin":"community","note":"Looks for suspicious PHP/XHTML on the appliance. Not CVE-2025-7775-specific."},{"title":"Nextron THOR compromise-assessment guidance","url":"https://www.nextron-systems.com/2025/09/08/cve-2025-7775-citrix-netscaler-detection-with-thor/","author":"Nextron","date":"2025-09-08","language":"yara","license":"see source","origin":"vendor","note":"Agentless scan of the appliance filesystem."}],"artefacts":[{"kind":"file","value":"Unexpected *.php under /var/netscaler/logon/, /var/vpn/, /netscaler/ns_gui/, /var/python/","detail":"CISA AA23-201A webshell hunt paths, reused here as a baseline.","sourceUrl":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a","sourceDate":"2023-07-20"},{"kind":"device-log","value":"httperror.log* lines naming unexpected .php or .sh","detail":"CISA AA23-201A log hunt.","sourceUrl":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a","sourceDate":"2023-07-20"}],"iocNote":"No CVE-2025-7775-specific file hashes or IPs from a primary vendor or government advisory are indexed here. News quotes are leads, not confirmed indicators.","hitMeaning":[{"level":"attempt","detail":"Anomalous httperror or VPN access lines with no filesystem change."},{"level":"likely-compromise","detail":"Unexpected PHP or XHTML on the appliance, or NCSC-NL / THOR hits that are not low-confidence."},{"level":"confirmed-compromise","detail":"A webshell or backdoor that persists after reboot or after the upgrade."}],"nextSteps":[{"title":"Upgrade and keep hunting","detail":"Install a fixed build, then continue the filesystem and log hunt. Do not treat the upgrade as clearance.","links":[{"label":"CTX694938","href":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938"}]},{"title":"Rotate secrets stored on or behind the Gateway","detail":"Assume credentials and sessions on a compromised appliance are exposed."}],"limits":["CISA AA23-201A was written for CVE-2023-3519. It is a transferable hunting baseline, not a CVE-2025-7775 root-cause detector.","No primary CVE-2025-7775 file-hash list is published in the sources reviewed here.","Appliances that never shipped logs off-box have no history after rotation."],"sources":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938","date":"2025-08-26","publisher":"Citrix"},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a","date":"2023-07-20","publisher":"CISA"},{"url":"https://www.nextron-systems.com/2025/09/08/cve-2025-7775-citrix-netscaler-detection-with-thor/","date":"2025-09-08","publisher":"Nextron"}],"updatedAt":"2026-10-24"},"amIAffected":{"summary":"NetScaler ADC and Gateway 14.1 before 14.1-47.48, 13.1 before 13.1-59.22, 13.1-FIPS/NDcPP before 13.1-37.241, and 12.1-FIPS/NDcPP before 12.1-55.330 are in scope when a CTX694938 precondition is present. General 12.1 and 13.0 are end of life and must move to a supported fixed train. CTX694938 applies to customer-managed appliances; Cloud Software Group upgrades Citrix-managed cloud services and Citrix-managed Adaptive Authentication.","checks":[{"id":"v2s-aia-citrix-netscaler-version-1","kind":"version","title":"Read the NetScaler build against the first-fixed releases","detail":"CTX694938 and NVD: 14.1 before 14.1-47.48; 13.1 before 13.1-59.22; 13.1-FIPS/NDcPP before 13.1-37.241; 12.1-FIPS/NDcPP before 12.1-55.330. General 12.1 and 13.0 are end of life. Record the NS build from the GUI System Information view or the build string at the top of a saved ns.conf. No public CLI version string was copied from CTX694938 in this pass.","command":"In the NetScaler GUI System Information view, or the build string at the top of a saved ns.conf, record the NS version (for example 14.1-47.48) and compare it to CTX694938 first-fixed builds.","affectedMeans":"14.1 before 14.1-47.48, 13.1 before 13.1-59.22, 13.1-FIPS/NDcPP before 13.1-37.241, 12.1-FIPS/NDcPP before 12.1-55.330, or any general 12.1 / 13.0 build (EOL; migrate to a supported fixed release).","fixedMeans":"14.1-47.48 or later, 13.1-59.22 or later, 13.1-FIPS/NDcPP 13.1-37.241 or later, or 12.1-FIPS/NDcPP 12.1-55.330 or later, after a compromise assessment. Citrix-managed cloud and Adaptive Authentication are vendor-managed.","sources":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938","date":"2025-08-26","publisher":"Citrix"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-7775","date":"2025-08-26","publisher":"NVD"}]},{"id":"v2s-aia-citrix-netscaler-config-2","kind":"config","title":"Confirm a CTX694938 precondition in ns.conf","detail":"CTX694938: the overflow applies when Gateway (VPN, ICA Proxy, CVPN, or RDP Proxy), an AAA virtual server, listed IPv6 or DBS IPv6 load-balancing bindings, or an HDX cache-redirection virtual server is in use. The bulletin publishes matching ns.conf strings including add vpn vserver and add authentication vserver. Version alone is not enough.","command":"grep -E 'add vpn vserver|add authentication vserver' ns.conf","affectedMeans":"A matching Gateway or AAA line on a build below the first-fixed release for that train. CTX694938 also lists IPv6 / DBS IPv6 load-balancing and HDX cache-redirection preconditions with their own ns.conf strings.","fixedMeans":"No listed precondition on the appliance, or the appliance is on a first-fixed build after a compromise assessment. Absence of a precondition does not change the version table.","notes":"This grep covers the two ns.conf tokens named in CTX694938. Check the bulletin for the IPv6 load-balancing and HDX strings rather than inventing them.","sources":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938","date":"2025-08-26","publisher":"Citrix"}]}],"limits":["A version string alone does not prove a precondition is present.","Citrix lists no workaround. A patched appliance can still hold a webshell (Horizon3.ai via Cybersecurity Dive; Nextron).","Citrix-managed cloud and Adaptive Authentication are vendor-managed, not a statement about customer-owned appliances."],"sources":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938","date":"2025-08-26","publisher":"Citrix"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-7775","date":"2025-08-26","publisher":"NVD"},{"url":"https://www.cybersecuritydive.com/news/citrix-netscaler-zero-day-active-exploitation/758738/","date":"2025-08-27","publisher":"Cybersecurity Dive"},{"url":"https://www.nextron-systems.com/2025/09/08/cve-2025-7775-citrix-netscaler-detection-with-thor/","date":"2025-09-08","publisher":"Nextron"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"mitigations":{"summary":"CTX694938 lists Workarounds/Mitigating Factors as None. CISA KEV tells you to apply vendor instructions or discontinue use. Patch is the only vendor fix.","items":[],"nonePublished":{"statement":"No vendor mitigation published; patch is the only fix","checkedDate":"2026-10-24","sources":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938","date":"2025-08-26","publisher":"Citrix"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-08-26","publisher":"CISA"}]},"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"response":{"summary":"Install a CTX694938 fixed build. Citrix, Horizon3.ai (via Cybersecurity Dive), and Nextron say webshells or backdoors can remain after the upgrade. Hunt with NCSC-NL or CISA AA23-201A paths before trusting the appliance.","containment":[{"title":"Install a fixed NetScaler build","detail":"CTX694938: 14.1-47.48 or later, 13.1-59.22 or later, 13.1-FIPS/NDcPP 13.1-37.241 or later, or 12.1-FIPS/NDcPP 12.1-55.330 or later. CISA KEV due date 28 Aug 2025: apply vendor instructions, follow BOD 22-01 for cloud services, or discontinue use if mitigations are unavailable. End-of-life 12.1 and 13.0 must move to a supported train.","sources":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938","date":"2025-08-26","publisher":"Citrix"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-08-26","publisher":"CISA"}]},{"title":"Compromise-assess even after the upgrade","detail":"Cybersecurity Dive quotes Horizon3.ai that active exploitation is creating backdoors that can persist after patches. Nextron (8 Sep 2025): patching is not enough; run an agentless filesystem hunt. NCSC-NL citrix-2025 scripts look for suspicious PHP/XHTML on live hosts.","sources":[{"url":"https://www.cybersecuritydive.com/news/citrix-netscaler-zero-day-active-exploitation/758738/","date":"2025-08-27","publisher":"Cybersecurity Dive"},{"url":"https://www.nextron-systems.com/2025/09/08/cve-2025-7775-citrix-netscaler-detection-with-thor/","date":"2025-09-08","publisher":"Nextron"},{"url":"https://github.com/NCSC-NL/citrix-2025","date":"2025-07-22","publisher":"NCSC-NL"}]},{"title":"Hunt new PHP under logon and vpn paths","detail":"CISA AA23-201A (written for CVE-2023-3519) documents find for new .php under /netscaler/ns_gui/, /var/vpn/, /var/netscaler/logon/, and /var/python/, plus httperror and VPN access review. Reused here as a transferable baseline, not a CVE-2025-7775 root-cause detector.","sources":[{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a","date":"2023-07-20","publisher":"CISA"}]},{"title":"Isolate an appliance with unexpected PHP or a non-low-confidence check hit","detail":"Take the management and Gateway listeners off untrusted networks until the filesystem hunt is finished and a fixed build is installed. Do not treat the upgrade as clearance.","generic":true}],"rotate":[{"item":"Credentials, sessions, and secrets stored on or behind the Gateway","reason":"Horizon3.ai (via Cybersecurity Dive) and Nextron treat a compromised appliance as able to keep access after a patch. CISA AA23-201A hunts shell history for ldapsearch, openssl, and keys paths. No CVE-2025-7775-specific rotate list was published in the sources reviewed here.","generic":true,"sources":[{"url":"https://www.cybersecuritydive.com/news/citrix-netscaler-zero-day-active-exploitation/758738/","date":"2025-08-27","publisher":"Cybersecurity Dive"},{"url":"https://www.nextron-systems.com/2025/09/08/cve-2025-7775-citrix-netscaler-detection-with-thor/","date":"2025-09-08","publisher":"Nextron"},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a","date":"2023-07-20","publisher":"CISA"}]}],"persistence":[{"kind":"webshell","value":"Unexpected *.php under /var/netscaler/logon/, /var/vpn/, /netscaler/ns_gui/, /var/python/","detail":"CISA AA23-201A webshell hunt paths, reused as a baseline for the 2025 Citrix wave. Infosecurity Magazine quotes Kevin Beaumont describing pre-authentication code execution used to drop webshells.","sourceUrl":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a","sourceDate":"2023-07-20"}],"evidence":[{"title":"Keep the pre-upgrade ns.conf and build string","detail":"CTX694938 uses ns.conf tokens to decide whether a precondition is present. Preserve a copy taken before the upgrade.","sources":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938","date":"2025-08-26","publisher":"Citrix"}]},{"title":"Filesystem find results and NCSC-NL or THOR output","detail":"Keep /var/log/custom_checks_* from NCSC-NL citrix-2025 and any agentless YARA/IOC report. Nextron published THOR guidance on 8 Sep 2025.","sources":[{"url":"https://github.com/NCSC-NL/citrix-2025","date":"2025-07-22","publisher":"NCSC-NL"},{"url":"https://www.nextron-systems.com/2025/09/08/cve-2025-7775-citrix-netscaler-detection-with-thor/","date":"2025-09-08","publisher":"Nextron"}]},{"title":"httperror, VPN access, and shell logs from 26 Aug 2025","detail":"CISA AA23-201A: zgrep httperror for .sh/.php; review httpaccess-vpn.log* and sh.log* / bash.log*.","sources":[{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a","date":"2023-07-20","publisher":"CISA"}]}],"limits":["CISA AA23-201A was written for CVE-2023-3519. It is a transferable hunting baseline, not a CVE-2025-7775 detector.","CTX694938 publishes no workaround and no CVE-2025-7775-specific file-hash list.","Appliances that never shipped logs off-box have no history after rotation."],"sources":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938","date":"2025-08-26","publisher":"Citrix"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-08-26","publisher":"CISA"},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a","date":"2023-07-20","publisher":"CISA"},{"url":"https://www.cybersecuritydive.com/news/citrix-netscaler-zero-day-active-exploitation/758738/","date":"2025-08-27","publisher":"Cybersecurity Dive"},{"url":"https://www.nextron-systems.com/2025/09/08/cve-2025-7775-citrix-netscaler-detection-with-thor/","date":"2025-09-08","publisher":"Nextron"},{"url":"https://github.com/NCSC-NL/citrix-2025","date":"2025-07-22","publisher":"NCSC-NL"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"bulletins":[{"vendor":"Citrix","title":"NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2025-7775, CVE-2025-7776 and CVE-2025-8424","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938","date":"2025-08-26","cve":"CVE-2025-7775"}],"coverage":[{"title":"CTX694938 Security Bulletin","publisher":"Citrix","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938","date":"2025-08-26","type":"vendor","addedDate":"2026-10-24"},{"title":"Critical security update announced for NetScaler","publisher":"NetScaler","url":"https://www.netscaler.com/blogs/2025-08/critical-security-update-announced-for-netscaler-gateway-and-netscaler","date":"2025-08-26","type":"vendor","addedDate":"2026-10-24"},{"title":"CISA KEV entry for CVE-2025-7775","publisher":"CISA","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-7775","date":"2025-08-26","type":"government","addedDate":"2026-10-24"},{"title":"Citrix Issues Emergency Patch for Actively Exploited NetScaler Zero-Days","publisher":"Infosecurity Magazine","url":"https://www.infosecurity-magazine.com/news/citrix-patch-netscaler-zero-days/","date":"2025-08-27","type":"news","addedDate":"2026-10-24"},{"title":"Citrix NetScaler zero-day under active exploitation","publisher":"Cybersecurity Dive","url":"https://www.cybersecuritydive.com/news/citrix-netscaler-zero-day-active-exploitation/758738/","date":"2025-08-27","type":"news","addedDate":"2026-10-24"},{"title":"CVE-2025-7775 Citrix NetScaler ADC and NetScaler Gateway zero-day","publisher":"Tenable","url":"https://www.tenable.com/blog/cve-2025-7775-citrix-netscaler-adc-and-netscaler-gateway-zero-day-remote-code-execution","date":"2025-08-26","type":"research","addedDate":"2026-10-24"},{"title":"CVE-2025-7775","publisher":"Arctic Wolf","url":"https://arcticwolf.com/resources/blog/cve-2025-7775/","date":"2025-08-26","type":"research","addedDate":"2026-10-24"},{"title":"CVE-2025-7775 Citrix NetScaler detection with THOR","publisher":"Nextron","url":"https://www.nextron-systems.com/2025/09/08/cve-2025-7775-citrix-netscaler-detection-with-thor/","date":"2025-09-08","type":"research","addedDate":"2026-10-24"}],"posts":[],"research":[{"title":"CTX694938 Security Bulletin","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938","authors":"Citrix (credits Jimi Sebree / Horizon3.ai, Jonathan Hetzer, Francois Haemmerli)","date":"2025-08-26"},{"title":"Critical security update announced for NetScaler","url":"https://www.netscaler.com/blogs/2025-08/critical-security-update-announced-for-netscaler-gateway-and-netscaler","authors":"NetScaler","date":"2025-08-26"},{"title":"NVD CVE-2025-7775","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-7775","authors":"NVD","date":"2025-08-26"},{"title":"CVE-2025-7775 detection with THOR","url":"https://www.nextron-systems.com/2025/09/08/cve-2025-7775-citrix-netscaler-detection-with-thor/","authors":"Nextron","date":"2025-09-08"},{"title":"AA23-201A (transferable NetScaler webshell hunting)","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-201a","authors":"CISA","date":"2023-07-20"}],"impact":{"kind":"single-product","product":"Citrix NetScaler ADC and NetScaler Gateway","versions":[{"version":"NetScaler ADC and Gateway 14.1","status":"affected","versions":">= 14.1-47.48","vendorStatement":{"date":"2025-08-26","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938","quote":"NetScaler ADC and NetScaler Gateway 14.1 BEFORE 14.1-47.48"},"addedDate":"2026-10-24"},{"version":"NetScaler ADC and Gateway 13.1","status":"affected","versions":">= 13.1-59.22","vendorStatement":{"date":"2025-08-26","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938","quote":"NetScaler ADC and NetScaler Gateway 13.1 BEFORE 13.1-59.22"},"addedDate":"2026-10-24"},{"version":"NetScaler ADC 13.1-FIPS and 13.1-NDcPP","status":"affected","versions":">= 13.1-37.241","vendorStatement":{"date":"2025-08-26","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938","quote":"NetScaler ADC 13.1-FIPS and NDcPP BEFORE 13.1-37.241-FIPS and NDcPP"},"addedDate":"2026-10-24"},{"version":"NetScaler ADC 12.1-FIPS and 12.1-NDcPP","status":"affected","versions":">= 12.1-55.330","vendorStatement":{"date":"2025-08-26","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938","quote":"NetScaler ADC 12.1-FIPS and NDcPP BEFORE 12.1-55.330-FIPS and NDcPP"},"addedDate":"2026-10-24"},{"version":"NetScaler ADC/Gateway 12.1 and 13.0 (non-FIPS general)","status":"eol-migrate","versions":"EOL / migrate to a supported fixed release","vendorStatement":{"date":"2025-08-26","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938","quote":"NetScaler ADC and NetScaler Gateway versions 12.1 and 13.0 are now End Of Life (EOL) and no longer supported. Customers are recommended to upgrade their appliances to one of the supported versions that address the vulnerabilities."},"addedDate":"2026-10-24"},{"version":"Citrix-managed cloud / Adaptive Authentication","status":"vendor-managed-no-action","vendorStatement":{"date":"2025-08-26","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938","quote":"This bulletin only applies to customer-managed NetScaler ADC and NetScaler Gateway. Cloud Software Group upgrades the Citrix-managed cloud services and Citrix-managed Adaptive Authentication with the necessary software updates."},"addedDate":"2026-10-24"}]},"pocs":[],"pocEmptyState":"Tenable and Arctic Wolf reported no public proof of concept at disclosure. Simulation repositories that say they do not contain real exploit code are not indexed here.","_feed":{"page":"https://vuln2shell.com/vulns/citrix-netscaler","json":"https://vuln2shell.com/vulns/citrix-netscaler.json","iocsCsv":"https://vuln2shell.com/vulns/citrix-netscaler/iocs.csv","stix":"https://vuln2shell.com/vulns/citrix-netscaler/stix.json"}}