# NetScaler ADC and Gateway RCE under active exploitation

Published: 2026-06-09 · Severity: high · Sectors: government-national, technology, financial-services, healthcare, defense
Canonical: https://vorant.io/reports/e109c3a0-a8f2-57c8-a1da-d4af90b48cb2/netscaler-adc-and-gateway-rce-under-active-exploitation

> Critical pre-auth RCE in NetScaler ADC and Gateway (CVE-2025-7775) is being exploited in the wild; patch immediately.

Citrix has disclosed multiple vulnerabilities in NetScaler ADC and NetScaler Gateway, with CVE-2025-7775 being actively exploited in the wild. This pre-authentication memory overflow vulnerability allows remote code execution and denial of service on affected appliances. CVE-2025-7776 is a separate memory overflow causing unpredictable behavior and DoS, while CVE-2025-8424 involves improper access control on the management interface. Affected versions include NetScaler ADC and Gateway 14.1 before 14.1-47.48, 13.1 before 13.1-59.22, and FIPS variants 13.1-37.241-FIPS and 12.1-55.330-FIPS. These are Internet-facing authentication and application delivery systems that attackers can compromise without credentials, making this an exceptional threat requiring immediate patching.

The pre-auth nature of CVE-2025-7775 means no authentication or user interaction is required for successful exploitation. Given that NetScaler ADC and Gateway are commonly used as perimeter security appliances in enterprise networks, compromise of these systems grants attackers deep network access and potential lateral movement capability. Organizations should treat this as requiring emergency patching and should assume unpatched systems have been compromised if they have been exposed to the Internet.

## Mentioned in this report

- Vulnerabilities: CVE-2025-7775 (KEV), CVE-2025-7776, CVE-2025-8424

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-netscaler-adc-and-netscaler-gateway-could-allow-for-remote-code-execution_2025-079

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e109c3a0-a8f2-57c8-a1da-d4af90b48cb2/netscaler-adc-and-gateway-rce-under-active-exploitation.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup