Citrix Patches Three Net Scaler Flaws, Confirms Active Exploitation of CVE-2025-7775

Summary: Citrix released fixes for three security flaws in NetScaler ADC and NetScaler Gateway, and acknowledged that exploits of CVE-2025-7775 on unmitigated appliances have been observed, without sharing further details. CISA added CVE-2025-7775 to its KEV catalog on August 26, 2025, requiring Federal Civilian Executive Branch agencies to remediate within 48 hours, by August 28.
Bottom line: CVE-2025-7775 is the third NetScaler ADC and Gateway flaw weaponized in real-world attacks in a short span, after CVE-2025-5777 (Citrix Bleed 2) and CVE-2025-6543, and CISA's 48-hour federal deadline signals it treats this one as already being used against targets.

Read the original at The Hacker News ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2024-8068 CVE-2024-8069 CVE-2025-5777 CVE-2025-6543 CVE-2025-7775
Related: Citrix Urges Patching Critical Net Scaler Flaw Allowing Unauthenticated Data Leaks Cyber Risks ·
Citrix Net Scaler Under Active Recon for CVE-2026-3055 (CVSS 9.3) Memory Overread Bug Cyber Risks ·
Amazon Uncovers Attacks Exploited Cisco ISE and Citrix Net Scaler as Zero-Day Flaws Cyber Risks ·