Citrix Gear Under Active Attack Again With Another Zero-Day

Citrix disclosed three critical vulnerabilities in NetScaler ADC and NetScaler Gateway, notably CVE-2025-7775 (CVSS 9.2), a memory overflow zero-day observed in active exploitation that can allow remote system takeover or denial-of-service; two additional high-severity flaws (CVE-2025-7776 and CVE-2025-8424) could cause unpredictable behavior or improper access. The weaknesses affect multiple supported and unsupported release lines (12.1, 13.1, 14.1), pose a high risk because appliances sit at the network perimeter, and Citrix and security vendors strongly urge immediate patching while warning that a significant number of devices remain on end-of-life versions.