NetScaler ADC and Gateway RCE under active exploitation
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Critical pre-auth RCE in NetScaler ADC and Gateway (CVE-2025-7775) is being exploited in the wild; patch immediately.
Citrix has disclosed multiple vulnerabilities in NetScaler ADC and NetScaler Gateway, with CVE-2025-7775 being actively exploited in the wild. This pre-authentication memory overflow vulnerability allows remote code execution and denial of service on affected appliances. CVE-2025-7776 is a separate memory overflow causing unpredictable behavior and DoS, while CVE-2025-8424 involves improper access control on the management interface. Affected versions include NetScaler ADC and Gateway 14.1 before 14.1-47.48, 13.1 before 13.1-59.22, and FIPS variants 13.1-37.241-FIPS and 12.1-55.330-FIPS. These are Internet-facing authentication and application delivery systems that attackers can compromise without credentials, making this an exceptional threat requiring immediate patching.
The pre-auth nature of CVE-2025-7775 means no authentication or user interaction is required for successful exploitation. Given that NetScaler ADC and Gateway are commonly used as perimeter security appliances in enterprise networks, compromise of these systems grants attackers deep network access and potential lateral movement capability. Organizations should treat this as requiring emergency patching and should assume unpatched systems have been compromised if they have been exposed to the Internet.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-netscaler-adc-and-netscaler-gateway-could-allow-for-remote-code-execution_2025-079
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs