CVE-2025-7775: presente nel catalogo CISA KEV

CVE-2025-7775 · CVSS 9.8 CRITICAL · EPSS 20% · KEV 2025-08-26 · patch disponibile

Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with IPv6 services or servicegroups bound with IPv6 servers (OR) NetScaler ADC and NetScaler Gateway 13.1, 14.1, 13.1-FIPS and NDcPP: LB virtual servers of type (HTTP, SSL or HTTP_QUIC) bound with DBS IPv6 services or servicegroups bound with IPv6 DBS servers (OR) CR virtual server with type HDX

CVE-2025-7775 viene sfruttato?

Inserito nel catalogo CISA KEV il 2025-08-26.
Scadenza di remediation federale: 2025-08-28.
Oltre quella data da 398 giorni.
EPSS stima la probabilità di sfruttamento nei prossimi 30 giorni al 20%.
Codice di exploit pubblico: nessuno trovato nelle fonti monitorate.

Quali prodotti e versioni sono interessati?

NetScaler · ADC · >= 14.1, < 47.48, >= 13.1, < 59.22, >= 13.1 FIPS and NDcPP, < 37.241, >= 12.1 FIPS and NDcPP, < 55.330
NetScaler · Gateway · >= 14.1, < 47.48, >= 13.1, < 59.22, >= 13.1 FIPS and NDcPP, < 37.241, >= 12.1 FIPS and NDcPP, < 55.330
citrix · netscaler application delivery controller · >= 12.1, < 12.1-55.330, >= 13.1, < 13.1-37.241, >= 13.1, < 13.1-59.22, >= 14.1, < 14.1-47.48
citrix · netscaler gateway · >= 13.1, < 13.1-59.22, >= 14.1, < 14.1-47.48

Esiste una patch?

netscaler application delivery controller 12.1-55.330, 13.1-37.241, 13.1-59.22, 14.1-47.48
netscaler gateway 13.1-59.22, 14.1-47.48

Cosa ha pubblicato PlainSec su CVE-2025-7775

Citrix NetScaler Exploitation Hits Gateways in the Wild (2026-09-29)

Fonti primarie

KEV ed EPSS vengono ricontrollati ogni giorno. Scheda aggiornata il 2026-09-29.