Security readout for executives and security teams
Plain-English summary
CVE-2025-7775 is a critical NetScaler ADC and Gateway memory overflow issue that can allow remote code execution or denial of service in specific Gateway, AAA, IPv6 load-balancing, DBS IPv6, or HDX content routing configurations.
Executive priority
Treat this as an emergency infrastructure risk where affected NetScaler services are exposed. KEV status means exploitation is not theoretical, and compromise could disrupt remote access or enable deeper intrusion.
Technical view
The vulnerability is classified as CWE-119 and has CVSS 4.0 score 9.2. It is network reachable, requires no privileges or user interaction, but has high complexity and required attack conditions. Impact can include high confidentiality, integrity, and availability compromise.
Likely exposure
Organizations using NetScaler ADC or Gateway versions 14.1, 13.1, FIPS/NDcPP branches, or 12.1 FIPS/NDcPP should assess exposure against the listed virtual server configurations. Product presence alone is not enough; configuration determines exposure.
Exploitation context
CISA KEV inclusion supports known exploitation in the wild. The provided sources do not include exploit mechanics, observed targeting detail, or proof-of-concept information. Treat internet-facing affected configurations as urgent.
Researcher notes
The source bundle confirms impact class, affected configuration categories, CVSS details, and KEV status. It does not provide exploit indicators, patch versions, or mitigation specifics beyond the vendor advisory reference, so validation should stay configuration-focused.
Mitigation direction
- Review NetScaler CTX694938 for vendor-directed remediation and affected build guidance.
- Prioritize remediation for internet-facing Gateway, AAA, IPv6 LB, DBS IPv6, and HDX CR configurations.
- Limit external exposure of affected virtual servers where operationally feasible.
- Monitor CISA KEV requirements and internal remediation deadlines.
- Increase logging and alerting around affected NetScaler services until remediated.
Validation and detection
- Inventory NetScaler ADC and Gateway versions and FIPS/NDcPP branches.
- Identify Gateway, AAA, LB IPv6, DBS IPv6, and HDX CR virtual server configurations.
- Confirm whether affected services are internet-facing or reachable from untrusted networks.
- Verify remediation status against the current NetScaler advisory.
- Review security monitoring for anomalies involving affected NetScaler services.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-119: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-7775 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.2 (4.0)
- Known Exploited
- Yes
- Published
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
9.2CriticalVector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
Source materials
- CVE List V5 sourceCVE List V5
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938CVE reference
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-7775CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.