Critical vulnerabilities discovered in Citrix NetScaler ADC and Gateway products
Take action: If you have self-hosted Citrix NetScaler ADC or Gateway, check if your version is still supported and apply the security patches. This is especially important if your Citrix functions as a gateway/VPN server. Take note that versions 12.1 and 13.0 are end-of-life with no fixes available. After patching, restart all active user sessions to clear any potential compromises from these critical vulnerabilities.
Learn More
Citrix has patched addressed two security vulnerabilities in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) products. The security flaws affect customer-managed NetScaler ADC and NetScaler Gateway instances. Organizations using Citrix-managed cloud services or Citrix-managed Adaptive Authentication are automatically patched
Vulnerabilities summary
- CVE-2025-5777 (CVSS score 9.3) insufficient input validation leading to memory overread . It could lead to the exposure of sensitive data through memory overread conditions. This vulnerability affects NetScaler products that must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. No authentication is required to exploit this flaw.
- CVE-2025-5349 (CVSS score 8.7) improper access control on the NetScaler Management Interface. It allows unauthorized users to potentially gain elevated access to the NetScaler Management Interface. This vulnerability requires access to NSIP, Cluster Management IP, or local GSLB Site IP as a precondition for exploitation.
The following supported versions of NetScaler ADC and NetScaler Gateway are impacted by these vulnerabilities:
- NetScaler ADC and NetScaler Gateway 14.1 BEFORE 14.1-43.56
- NetScaler ADC and NetScaler Gateway 13.1 BEFORE 13.1-58.32
- NetScaler ADC 13.1-FIPS and NDcPP BEFORE 13.1-37.235-FIPS and NDcPP
- NetScaler ADC 12.1-FIPS BEFORE 12.1-55.328-FIPS
Cloud Software Group has emphasized that NetScaler ADC and NetScaler Gateway versions 12.1 and 13.0 have reached End of Life (EOL) status and are no longer receiving security
Cloud Software Group strongly urges affected customers to install the following updated versions immediately:
- NetScaler ADC and NetScaler Gateway 14.1-43.56 and later releases
- NetScaler ADC and NetScaler Gateway 13.1-58.32 and later releases of 13.1
- NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.235 and later releases
- NetScaler ADC 12.1-FIPS 12.1-55.328 and later releases of 12.1-FIPS
Additionally, Cloud Software Group recommends running commands to terminate all active ICA and PCoIP sessions after upgrading all NetScaler appliances in high availability pairs or clusters to the fixed builds. This ensures that any potentially compromised sessions are cleared following the security update.
