Vulnerabilities:
CVE‑2025‑7776 – 8.8 High
Executive Summary
Citrix has issued patches for a high‑severity flaw tracked as CVE‑2025‑7776. The bug affects NetScaler ADC and NetScaler Gateway appliances when a PCoIP Profile is bound to a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy). This vulnerability is a memory overflow that can cause devices to behave unpredictably or stop responding. While there is no evidence of exploitation at this time, its CVSS 4.0 rating of 8.8 means organizations should remediate quickly.
Details
- The issue is limited to deployments using a PCoIP Profile on a Gateway configuration.
- Improper memory handling creates conditions where crafted requests could crash or disrupt service.
- Versions impacted: This issue impacts NetScaler ADC and Gateway versions that are not on the most recent security builds. That includes 14.1 versions older than 14.1-47.48, 13.1 versions older than 13.1-59.22, and the FIPS/NDcPP editions of 13.1 and 12.1 if they are running builds earlier than 13.1-37.241 or 12.1-55.330. Organizations operating on these vulnerable builds should promptly apply the latest updates to reduce exposure and prevent possible attacks.
Impact
- Gateway services could become unstable or unavailable, affecting remote work and secure access.
- Because only systems with PCoIP Profiles are exposed, the number of vulnerable deployments is smaller but still significant.
- Even though exploitation has not been observed, the potential for disruption requires immediate action.
Mitigation Strategies
- Review configurations by checking the ns.conf file for Gateway entries that reference PCoIP Profiles.
- Apply the latest patches released by Citrix (upgrade to fixed releases 14.1‑47.48, 13.1‑59.22, 13.1‑37.241 (FIPS/NDcPP), or 12.1‑55.330 (FIPS/NDcPP).
- Use the advisory dashboard to run a CVE‑2025‑7776 scan if managing via NetScaler Console.
Sources
Contributing Author
Benjamin Kalombo – Cybersecurity Analyst II
