Is CVE-2025-7775 (Citrix NetScaler Memory Overflow) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2025-7775 to its Known Exploited Vulnerabilities catalogue on 26 August 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Citrix NetScaler ADC and NetScaler Gateway contain a memory overflow vulnerability that could allow for remote code execution and/or denial of service.

What active exploitation means for Citrix NetScaler customers

For a public-facing appliance issue like this, “being exploited in the wild” means the question is no longer academic: the vulnerable service is attractive because it sits on the edge of the environment and can be reached before other controls can help. That changes the priority from routine remediation to exposure confirmation, emergency mitigation, and checking whether the device was used as the initial foothold.

When the affected product is an edge gateway, treat the appliance itself as part of the trust boundary, not just another server. If that boundary is exposed to the internet, the practical concern is whether an attacker can turn a memory flaw into code execution, denial of service, or a path into authenticated sessions and downstream systems.

For readers maintaining internet-facing appliances, the most useful first pass is to identify where the product is deployed, whether it is directly reachable from untrusted networks, and whether it is handling high-value authentication or VPN traffic. NHIMG’s Edge Device Security Guide is a good fit when you need to think about appliance exposure, management surface reduction, logging minimums, and end-of-life planning together.

Why CISA KEV listing is a strong signal, but not the whole answer

CISA’s KEV catalogue is a prioritisation signal, not a full incident report. A KEV entry tells you the issue has crossed the threshold from theoretical weakness to confirmed exploitation, which is enough to justify urgent action even when you do not yet know whether your own instance has been touched. The operational question becomes whether your environment has the vulnerable path, whether compensating controls are present, and whether the device has observable signs of abuse.

That is why zero-day and actively exploited vulnerability workflows matter here. The right response is to verify exposure, apply the vendor fix or mitigation as directed, and if you must delay, use containment measures that reduce external reachability and limit what the appliance can reach internally. NHIMG’s Zero-Day and Exploited Vulnerabilities Guide and Vulnerability Management Guide both support that decision path: emergency triage, exception handling, verification, and remediation tracking are more important than waiting for normal patch cycles.

In practice, the KEV listing should also trigger a review of any compensating assumptions you made about Citrix NetScaler being “just an appliance.” If it fronts remote access, authentication, or session handling, exploitation can have blast radius well beyond the device itself.

What to check if patching is delayed or compromise is possible

If you cannot remediate immediately, the question shifts from “is the flaw exploitable?” to “what evidence would show it was used?” That means reviewing appliance logs, authentication anomalies, unexpected crashes, new accounts or configuration changes, and unusual outbound connections. It also means checking whether the device was used to proxy or terminate sensitive user sessions.

Because memory corruption issues on edge devices can be paired with credential or session theft, incident response should not stop at the appliance. Follow the trail into VPN sessions, privileged access paths, and any systems reachable from the gateway. NHIMG’s CitrixBleed 2 2025 page is especially relevant as a nearby exploitation pattern, because it shows how NetScaler memory bugs can lead to session abuse, not just service instability.

Where a gateway may have exposed session state, treat credential and session rotation as part of the response, not an optional add-on. If there is any indication of compromise, rotate administrative credentials, invalidate active sessions, and review whether any downstream secrets were reachable through the appliance.

Risk and Threat Considerations

Publicly reachable gateway flaws are high-value because they sit in front of trusted access paths. A memory overflow in this position can support denial of service, remote code execution, or post-exploitation access to authenticated traffic and internal resources, which makes the business impact larger than the vulnerability label alone suggests.

Failure mechanism: Attackers target the exposed NetScaler service, trigger unsafe memory handling, and use the resulting crash or code execution opportunity to gain control, disrupt availability, or observe and reuse session-related material.

Impact: The likely consequences are service outage, possible appliance takeover, and a wider trust compromise if the gateway was terminating remote access or privileged sessions.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation and KEV status require urgent vulnerability triage and remediation prioritization.
Recommendation — Prioritize and remediate KEV-listed appliance vulnerabilities first.
NIST CSF 2.0	GV.RM-01 — Risk Management Strategy	KEV-driven exploitation changes the organization's risk acceptance and response timing.
	DE.CM-01 — Networks and systems are monitored to detect potential cybersecurity events	Potential appliance compromise requires monitoring for exploitation indicators and anomalous access.
Recommendation — Escalate KEV-listed exposure into your formal risk and remediation workflow. Monitor gateway logs and session activity for signs of exploitation.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The question centers on an exploited vulnerability and the need to apply the vendor fix or mitigation.
	AU-6 — Audit Record Review, Analysis, and Reporting	Checking for earlier compromise depends on reviewing appliance and access logs for suspicious activity.
Recommendation — Apply the vendor fix or mitigation without waiting for the normal patch cycle. Review logs and alerts to identify signs of appliance abuse or session theft.

Practitioner Guidance

What to verify: Confirm whether any Citrix NetScaler ADC or NetScaler Gateway instance is internet-facing, whether it is covered by the vendor’s remediation path, and whether your exposure includes administrative interfaces or remote-access workloads. Treat a positive KEV listing as a trigger to check your own environment, not as proof that compromise has already happened.

Decision rule: If the appliance supports production remote access, prioritise emergency remediation and session review before lower-priority maintenance work. If patching must wait, narrow exposure first, then validate whether logs, session history, or crash indicators suggest the flaw was exercised.

Practitioner takeaway: For edge gateways, the right question is not only whether a CVE is being exploited, but whether the appliance has already become part of your access trust chain, because that determines how wide the response needs to be.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org