Research · Aug 26, 2025 · ZeroDay Catalog
Critical Memory Overflow Vulnerability in Citrix NetScaler
A memory overflow vulnerability in Citrix NetScaler could lead to remote code execution or denial of service, impacting various configurations.
What changed
A newly identified memory overflow vulnerability in Citrix NetScaler has been reported, which may allow attackers to execute arbitrary code or cause a denial of service. This vulnerability is particularly critical when NetScaler is configured for specific roles such as Gateway or AAA virtual servers.
- The vulnerability affects NetScaler ADC and NetScaler Gateway versions 13.1, 14.1, and 13.1-FIPS.
- It is triggered when the NetScaler is configured with IPv6 services or service groups.
- The risk is heightened when using load balancing virtual servers of types HTTP, SSL, or HTTP_QUIC.
Who is affected
Organizations utilizing Citrix NetScaler products for their networking and application delivery may be at risk. The following groups should pay particular attention to this vulnerability.
- Enterprises using Citrix NetScaler ADC for application delivery.
- Organizations employing NetScaler Gateway for secure remote access.
- Users of load balancing configurations that involve IPv6 services.
- FIPS-compliant environments relying on NetScaler 13.1-FIPS.
What to do
It is crucial for affected organizations to assess their configurations and apply necessary mitigations. Immediate action is recommended to prevent exploitation.
- Review and update to the latest version of Citrix NetScaler to mitigate the vulnerability.
- Reconfigure any NetScaler instances that utilize IPv6 services to reduce exposure.
- Monitor network traffic for unusual activities that may indicate exploitation attempts.
- Consult Citrix security advisories for detailed guidance on remediation.