Citrix NetScaler Devices Yet Again Under Attack

NetScaler customers of virtualization giant Citrix once again should patch immediately to stymie the hackers exploiting a zero-day.

See Also: OnDemand Webinar | Trends, Threats and Expert Takeaways: 2025 Global IR Report Insights

Citrix warned Tuesday that hackers are using a memory overflow vulnerability now tracked as CVE-2025-7775 to potentially execute remote code. The vulnerability carries a CVSS score of 9.2 out of a possible 10.

“There’s a bunch of new NetScaler vulns being exploited as zero-days. Patches just out now,” wrote security researcher Kevin Beaumont early on Tuesday morning.

The zero-day is one of three flaws for which Citrix published patches affecting the NetScaler application delivery controller and NetScaler Gateway, which can function as a VPN virtual server or proxy. Patches are available for currently supported versions – but “analysis of Tenable telemetry data found that nearly 20% of NetScaler assets identified” are unsupported versions, said cybersecurity firm Tenable. Any organization using version 12.0 or 13.0 of the two products should upgrade, Citrix said.

“These end-of-life instances are ticking time bombs, especially given the recent exploitation history of Citrix flaws,” said Scott Caveza, a Tenable senior staff research engineer. Security companies warn that hackers, and nation-state hackers in particular, have become adept at acting quickly to exploit vulnerabilities in the way of public disclosure (see: Likely Chinese Hacking Contractor Is Quick to Exploit N-Days).

Caveza’s reference to “recent exploitation history” alludes to flaws in NetScaler devices patched earlier this summer. One of the flaws, CVE-2025-5777, earned the moniker “Citrix Bleed 2” from Beaumont for its similarity to the original Citrix Bleed vulnerabilities uncovered in 2023 (see: Ransomware Groups Exploiting Unpatched NetScaler Devices).

Citrix said on-premise and hybrid deployment of Secure Private Access, a solution for tunneling access to internal company apps without recourse to a VPN, are also affected by the flaws.

The spate of NetScaler vulnerabilities has left some cybersecurity experts jaundiced. “Well well well … another day ending in ‘day.’ Once again, we’re seeing new vulnerabilities in Citrix NetScaler facilitating total compromise,” said Benjamin Harris, CEO and founder of watchTowr. He also urged NetScaler customers to review for signs of compromise – merely applying the patch could just shut the door behind hackers who are already inside the network, he said.

Caitlin Condon, vice president of security research at VulnCheck, said it’s likely that nation-state hackers rather than “commodity attackers” are likely to exploit the new NetScaler vulnerabilities. Memory corruption vulnerabilities such as CVE-2025-7775 “can be tricky to exploit,” she said. A similar NetScaler vulnerability tracked as CVE-2025-6543 “has yet to see exploitation at scale” despite known instances of attackers using it, she added.