Vulnerability

CERT-In Vulnerability Note CIVN-2025-0196
Multiple Vulnerabilities in NetScaler ADC and NetScaler Gateway

Original Issue Date:August 27, 2025

Severity Rating: HIGH

Software Affected

NetScaler ADC and NetScaler Gateway 14.1 before 14.1-47.48
NetScaler ADC and NetScaler Gateway 13.1 before 13.1-59.22
NetScaler ADC 13.1-FIPS and NDcPP before 13.1-37.241-FIPS and NDcPP
NetScaler ADC 12.1-FIPS and NDcPP before 12.1-55.330-FIPS and NDcPP

Overview

Multiple vulnerabilities have been reported in NetScaler ADC and NetScaler Gateway which could allow an attacker to bypass the security restrictions, remote code execution or cause denial of service (DoS) condition on the targeted system.

Target Audience:
All end-user organizations and individuals using NetScaler ADC and NetScaler Gateway.

Risk Assessment:
High risk of unauthorized access to sensitive data and potential compromise.

Impact Assessment:
Remote code execution, Bypass security restrictions, Denial of service (DoS).

Description

NetScaler ADC is a network appliance (hardware, virtual, or cloud-based) designed to optimize, secure, and control application delivery. NetScaler Gateway provides secure remote access to internal applications, desktops, and data.

These vulnerabilities exist in NetScaler ADC and NetScaler Gateway due to improper access control and input handling flaws. An attacker could exploit these vulnerabilities by sending specially crafted network requests on the targeted system.

Successful exploitation of these vulnerabilities could allow an attacker to bypass the security restrictions, remote code execution or cause denial of service (DoS) condition on the targeted system.

Solution

Apply appropriate updates as mentioned in:
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938

Vendor Information

Citrix
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938

References

Citrix
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938

CVE Name
CVE-2025-7775
CVE-2025-7776
CVE-2025-8424

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India