The short answer
- Affected
- NetScaler ADC and NetScaler Gateway builds below the first fixed build for their release, when the precondition below is met.
- Fixed in
- 14.1-47.48 / 13.1-59.22First fixed builds for 14.1 / 13.1. All releases in the table below.
- Current safe build
- 14.1-73.46 / 13.1-64.29Includes later fixes. Advisory data as of 2026-10-15.
- CISA KEV
- Added 2025-08-26, federal due date 2025-08-28. Known ransomware use: Unknown.
- Forensic triage
- No forensic triage flag on this KEV entry.
- CVSS
- 9.2 (CVSS v4.0, vendor score in CTX694938)
- Preconditions
- Gateway or AAA vserver; OR LB vserver (HTTP/SSL/HTTP_QUIC) bound to IPv6 services; OR CR vserver of type HDX
- Session kill advised
- No. The bulletin does not call for session termination.
Fixed builds from the Citrix® security bulletin CTX694938
| Release | First fixed build | Current safe build |
|---|---|---|
| NetScaler 14.1 | 14.1-47.48 | 14.1-73.46 |
| NetScaler 13.1Past end of maintenance | 13.1-59.22 | 13.1-64.29 |
| NetScaler 13.1 FIPS/NDcPPPast end of maintenance | 13.1-37.241 FIPS | 13.1-37.283 FIPS |
| NetScaler 12.1 FIPS/NDcPP | 12.1-55.330 FIPS | 12.1-55.330 FIPS |
FIPS and NDcPP builds have separate fixed builds: see the table and the bulletin.
What it is
“Citrix NetScaler Memory Overflow Vulnerability”
Our advisory data, taken from CTX694938, summarises it as: Memory overflow leading to RCE or DoS. Vulnerability class: memory overflow (CWE-119). Precondition: Gateway or AAA vserver; OR LB vserver (HTTP/SSL/HTTP_QUIC) bound to IPv6 services; OR CR vserver of type HDX.
For the full description, read the CVE.org record for CVE-2025-7775 and the vendor bulletin.
Am I affected?
Two things must both be true: the appliance runs a build below the fixed build for its release (see the table above), and its configuration meets the precondition: Gateway or AAA vserver; OR LB vserver (HTTP/SSL/HTTP_QUIC) bound to IPv6 services; OR CR vserver of type HDX. Find the build with show ns version on the CLI.
Enter your build to check it against CVE-2025-7775 and every other NetScaler CVE in our data. The checker runs in your browser and never connects to any appliance.
Open the checker with CVE-2025-7775 highlightedHow to patch
- Choose the target build: at least
14.1-47.48on 14.1 or13.1-59.22on 13.1. Prefer the current safe build (14.1-73.46 / 13.1-64.29), which also includes later fixes. FIPS and NDcPP appliances need their own fixed build from the table above. - Upgrade every node. In an HA pair, upgrade the secondary first, fail over, then upgrade the former primary. Our HA pair upgrade runbook walks through each step and the rollback.
- Confirm the build on each node with
show ns version, then work through the post-patch steps below.
13.1 is past end of maintenance, so plan the move to 14.1 while you are in the change window. Check the release dates in our NetScaler end-of-life guide.
After patching
Steps in the vendor bulletin
vendor bulletinThe bulletin does not call for session termination. It lists no post-patch steps beyond the upgrade.
Hunt for compromise
Upgrading does not remove an existing compromise. These indicators and tools are published guidance; we do not run them for you.
Configuration precondition checks from the bulletin (grep ns.conf)
- add authentication vserver
- add vpn vserver
- enable ns feature lb
- add cr vserver .* HDX
- -pcoipVserverProfileName
Tools: Fox-IT scan-citrix-netscaler-version.py (remote build -> CVE)
Source: CTX694938; Fox-IT
Timeline
- Vendor bulletin CTX694938 published with fixed builds
- Added to the CISA Known Exploited Vulnerabilities catalog
- CISA federal remediation due date
Related CVEs
- CVE-2025-7776Memory overflow leading to DoSNot in KEVSame bulletin (CTX694938)
- CVE-2025-8424Improper access control on the management interfaceNot in KEVSame bulletin (CTX694938)
Sources
- Vendor bulletin: CTX694938, NetScaler ADC and Gateway security bulletin for CVE-2025-7775, CVE-2025-7776 and CVE-2025-8424 (published 2025-08-26)
- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-7775
- CISA KEV catalog JSON feed, version 2026.10.15: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Last verified 2026-10-15 against CISA KEV and CVE.org. Advisory data version 2026.10.15-1.