CVE-2025-7776 is a critical (CVSS 9.8) memory overflow in Citrix NetScaler ADC and NetScaler Gateway when a Gateway is configured with a PCoIP profile bound to it. It can cause unpredictable behaviour and denial of service. NVD lists 14.1-47.48 and 13.1-59.22 as the first fixed builds, so upgrade.
What's affected
The condition matters as much as the version. The record says the flaw is reachable when NetScaler is configured as a Gateway (a VPN virtual server, ICA Proxy, CVPN or RDP Proxy) with a PCoIP profile bound to it. An appliance used only for load balancing, with no Gateway and no PCoIP profile, is outside the described condition.
Affected products, per the NVD configuration data for this CVE:
- NetScaler ADC and NetScaler Gateway 14.1 before 14.1-47.48
- NetScaler ADC and NetScaler Gateway 13.1 before 13.1-59.22
- NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1-37.241
- NetScaler ADC 12.1-FIPS and 12.1-NDcPP before 12.1-55.330
I could not read the Citrix bulletin (CTX694938). The page loads its content with scripts and returned only an empty shell to my fetch. The versions above come from NVD, so confirm them against the bulletin and use the build Citrix names for your release train. Check the bulletin too for the status of older branches, which I could not confirm.
There is a source conflict on severity. The record, which follows the NVD base score, gives CVSS 9.8, Critical. The NVD entry also carries a secondary CVSS 4.0 score from Citrix of 8.8, High, with high impact on availability and low impact on confidentiality and integrity. Both are in the sources. The 9.8 figure treats the flaw as a full compromise, while the description text speaks of erroneous behaviour and denial of service. Plan on the faster timeline, and read the Citrix bulletin for its own wording.
On exploitation, the record does not flag this CVE as a CISA Known Exploited Vulnerability, and I could not read an advisory that says it is exploited. Check the CISA catalog and Citrix's bulletin for current status, because that can change after a record is written.
How to check if you're exposed
Start with the version, from the NetScaler CLI:
show ns version
Compare the build with the list above for your branch. Then check whether the condition applies. Look for a Gateway virtual server and a PCoIP profile in the running configuration:
show ns runningConfig | grep -i pcoip
show vpn vserver
If there is no PCoIP profile bound to a Gateway virtual server, the described condition is not met. If there is one, and the build is below the fixed one, you are exposed. The Citrix bulletin has its own configuration check, and its steps win if they differ from this summary.
For an estate with many appliances, record version, branch and Gateway use in one place. A spreadsheet is fine at first, but it will go stale. Safeguard's free in-browser dependency scan is for software dependencies and will not inspect an appliance, so do this check from the appliance side.
What to do now
- List every NetScaler ADC and Gateway appliance, its branch and its build.
- Mark the ones with a Gateway virtual server and a PCoIP profile. Those come first.
- Plan the upgrade to the fixed build for each branch: 14.1-47.48 or later, 13.1-59.22 or later, 13.1-37.241 or later for FIPS and NDcPP, or 12.1-55.330 or later for those editions. Confirm in the Citrix bulletin.
- Take a configuration backup before you upgrade, and test the upgrade on a standby or lab unit where you can.
- Where you cannot upgrade soon, ask whether the PCoIP profile is needed. Removing an unneeded binding removes the described condition, but check the bulletin for any mitigation guidance before you change production.
- After the upgrade, confirm the version again and watch for unexpected restarts. A memory problem often shows as a crash or a core file, so review those from before the change too.
Try it yourself
This walkthrough shows how a scan finds a flaw of this class and what the finding looks like.
Click through it at your own pace, or open it full screen.
Why it matters
CWE-119 is improper restriction of operations within the bounds of a memory buffer. In plain terms, the code writes or reads past the end of a block of memory it set aside. The result can be a crash, strange behaviour, or in some cases control of the process. The description here names erroneous behaviour and denial of service.
This sits on an edge device. A NetScaler Gateway answers to the internet by design, so a flaw reachable without login is on the front line. Edge appliances also tend to be patched slowly, because an upgrade means a maintenance window and sometimes an outage. That is why the exposure condition is worth checking first, so that you can sort the appliances by real risk.
Quick check
Am I affected if I only use NetScaler as a load balancer?
The record describes the flaw for a Gateway configuration with a PCoIP profile bound to it. An appliance without that configuration is outside the described condition. Confirm in the Citrix bulletin before you rule it out.
Why do two severity scores appear for this CVE?
The record shows CVSS 9.8, Critical. NVD also lists a Citrix supplied CVSS 4.0 score of 8.8, High. They use different versions of the scoring system and different judgements of impact. Treat the higher one as the planning figure until you have read the Citrix bulletin.
Sources
- CVE-2025-7776 on Gold
- NVD entry for CVE-2025-7776
- Citrix bulletin CTX694938 (page did not render for my fetch)
Last reviewed: 18 October 2026.
