Kevin BeaumontAug 26, 2025

There’s a bunch of new Netscaler vulns being exploited as zero days. Patches just out now.

Preauth RCE being used to drop webshells to backdoor orgs. CVE-2025-7775 is the main problem.

Orgs will need to do IR afterwards as technical details emerge of backdoor.

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938&articleTitle=NetScaler_ADC_and_NetScaler_Gateway_Security_Bulletin_for_CVE_2025_7775_CVE_2025_7776_and_CVE_2025_8424

Loading...

Show threadKevin BeaumontAug 26, 2025
Must be Tuesday.
Show threadKevin BeaumontAug 26, 2025
Internet scanning for hosts vulnerable to CVE-2025-7775 (CitrixDeelb) has begun, will put up results tomorrow or Friday.
Show threadKevin BeaumontAug 26, 2025
16% patch rate, 84% unpatched if anybody interested
Show threadKevin BeaumontAug 27, 2025
Citrix Netscaler boxes presented to the internet over time, for anybody interested, pulled via @shodan
Show threadKevin BeaumontAug 27, 2025

The NCSC have published an advisory on CVE-2025-7775 (CitrixDeelb), saying it is highly likely it will be mass exploited:

https://advisories.ncsc.nl/2025/ncsc-2025-0268.html

They've also published a script to check for post exploitation, i.e. backdoor access which persists post patching: https://github.com/NCSC-NL/citrix-2025/blob/main/live-host-bash-check/TLPCLEAR_check_script_cve-2025-6543-v1.8.sh

NCSC NL | Beveiligingsadviezen

NCSC NL | Beveiligingsadviezen

Show threadKevin BeaumontAug 27, 2025

Cloud Software Group, who own Netscaler, have published their own blog about CVE-2025-7775 (CitrixDeelb)

https://www.netscaler.com/blog/news/critical-security-update-announced-for-netscaler-gateway-and-netscaler/

...however they've incorrectly said it applies to IPv6 setups only. This is wrong. They've missed the "OR" statements from their own advisory.

Show threadKevin BeaumontAug 27, 2025
Here's the Citrix advisory, if anybody knows anybody at Cloud Software Group please get them to correct the blog post - it's a repeat of the CitrixBleed 2 situation again where the wrong information has been published to customers again.
Show threadKevin Beaumont

I've published scan results for CVE-2025-7775 (CitrixDeelb - which Bleed is spelt backwards as the CVE number is reverse of CitrixBleed2  )

Columns = IP, SSL hostnames, firmware version, vulnerable to CVE-2025-7775 exploitation.

https://raw.githubusercontent.com/GossiTheDog/scanning/refs/heads/main/CVE-2025-7775-Citrix-Netscaler.csv

Aug 28, 2025 at 8:57amWeb
Show threadsusika512 Aug 28, 2025
@GossiTheDog the amount of unpatched 😳...
Show threadMariusAug 28, 2025
@GossiTheDog These results are atleast 20 hours old? I can confirm one hit on your list is in fact patched.
Show threadFL | エフルAug 28, 2025
@fere @GossiTheDog same thing, some entries in the list are either false positive or the scan is old
Show threadbrummelbärAug 28, 2025
@fl @fere @GossiTheDog Same here, but that's to be expected in an evolving situation
Show threadVessOnSecurityAug 28, 2025

@GossiTheDog Yay, only 8 in Bulgaria, most of them belonging to foreign companies, 3 of them in the same company. A1 is a telecom; these are probably residential IPs - but maybe somebody ought to call the US bank and the German insurance company here and tell them that they have a little bit of a problem...

88.203.128.230,Bulgaria,Sofia,A1 Bulgaria EAD
195.191.94.244,Bulgaria,,Bulgarian-American Credit Bank JSC
92.247.124.120,Bulgaria,Sofia,Ultracom Ltd.
213.169.55.20,Bulgaria,,A1 Bulgaria EAD
91.216.174.52,Bulgaria,,ZAD Allianz Bulgaria AD
91.216.174.42,Bulgaria,,ZAD Allianz Bulgaria AD
91.216.174.53,Bulgaria,,ZAD Allianz Bulgaria AD
213.169.55.31,Bulgaria,,A1 Bulgaria EAD

Show threadZack WhittakerAug 28, 2025
@GossiTheDog "CitrixDeelb..."
Show threadTino aka Paladin316Aug 28, 2025

@GossiTheDog thanks for the list. Will there be an updated list for those who have already patched?

Nm, I saw your response above rescan running now. Thanks again for all your work to help the community.

Show thread decioAug 28, 2025
@GossiTheDog Thanks👍
Show threadT1- Push The ButtonAug 28, 2025
@GossiTheDog how did you pull the versions?
Show threadT1- Push The ButtonAug 29, 2025
@GossiTheDog Bump
Show threadYunSep 4, 2025
@Just_Patch_It @GossiTheDog I maintain the NetScaler version info here: https://github.com/fox-it/citrix-netscaler-triage/blob/main/scan-citrix-netscaler-version.py
citrix-netscaler-triage/scan-citrix-netscaler-version.py at main · fox-it/citrix-netscaler-triage

Dissect triage scripts for Citrix NetScaler devices - fox-it/citrix-netscaler-triage

GitHub
Show threadKetumbraAug 29, 2025
@GossiTheDog Thanks a lot for the scan data and blog!
Unfortunately without accurate timestamps on the scans it's causing unnecessary stress as NCSC reach out to us who reach out to our citrix team who say it's been patched and we get left with a hazy probability that we're fully patched ;)
Any chance next time you could a column for when each device was scanned? If it's not too much bother.
Thanks again