Cyber Posture

CVE-2025-7776

Critical

Published: 26 August 2025

Published
26 August 2025
Modified
03 September 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0025 48.3th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-7776 is a critical-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Citrix Netscaler Application Delivery Controller. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

SI-2 mandates identification, reporting, and correction of system flaws like the memory overflow in CVE-2025-7776 through timely patching as per vendor advisories.

prevent

SI-16 implements memory protection mechanisms such as address space layout randomization and non-executable memory to prevent exploitation of the memory overflow vulnerability.

prevent

SI-10 enforces validation of information inputs, preventing malformed PCoIP traffic from triggering the memory overflow in NetScaler Gateway configurations.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Memory overflow in public-facing NetScaler Gateway enables remote unauthenticated exploitation for RCE or DoS, directly mapping to exploitation of internet-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) with PCoIP Profile bounded to it

Deeper analysisAI

CVE-2025-7776 is a memory overflow vulnerability (CWE-119) affecting NetScaler ADC and NetScaler Gateway. The issue arises specifically when NetScaler is configured as a Gateway, including VPN virtual server, ICA Proxy, CVPN, or RDP Proxy configurations with a PCoIP Profile bound to it. This flaw can lead to unpredictable or erroneous behavior as well as Denial of Service conditions. It has a CVSS v3.1 base score of 9.8, reflecting its critical severity.

Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation can result in high impacts to confidentiality, integrity, and availability, enabling attackers to cause denial of service or potentially execute arbitrary code due to the memory overflow.

For mitigation details, refer to the Citrix advisory at https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938.

Details

CWE(s)

Affected Products

citrix
netscaler application delivery controller
12.1 — 12.1-55.330 · 12.1 — 12.1-55.330 · 13.1 — 13.1-37.241
citrix
netscaler gateway
13.1 — 13.1-59.22 · 14.1 — 14.1-47.48

CVEs Like This One

CVE-2025-7775Same product: Citrix Netscaler Application Delivery Controller
CVE-2026-3055Same product: Citrix Netscaler Application Delivery Controller
CVE-2025-24472Same product class: VPN / SSL gateway
CVE-2025-25249Same product class: VPN / SSL gateway
CVE-2024-55591Same product class: VPN / SSL gateway
CVE-2025-53847Same product class: VPN / SSL gateway
CVE-2025-55147Same product class: VPN / SSL gateway
CVE-2026-24858Same product class: VPN / SSL gateway
CVE-2025-0282Same product class: VPN / SSL gateway
CVE-2024-45324Same product class: VPN / SSL gateway

References