Citrix on Tuesday announced patches for four vulnerabilities across three products, including a critical-severity issue in NetScaler ADC and NetScaler Gateway.
The critical flaw, tracked as CVE-2025-5777 (CVSS score of 9.3), is described as an out-of-bounds memory read caused by insufficient input validation.
Only NetScaler deployments configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or as Authentication, Authorization, and Accounting (AAA) virtual server are affected, Citrix explains in its advisory.
The flaw was addressed in NetScaler ADC versions 14.1-43.56, 13.1-58.32, 13.1-FIPS, 13.1-NDcPP 13.1-37.235, and 12.1-FIPS 12.1-55.328, and in NetScaler Gateway versions 14.1-43.56 and 13.1-58.32.
The updates also address CVE-2025-5349, a high-severity improper access control issue in the NetScaler Management Interface.
Citrix warns that NetScaler ADC and Gateway versions 12.1 and 13.0, which have been discontinued, are affected by these vulnerabilities too, urging customers to upgrade to a supported iteration as soon as possible.
On Tuesday, the company also released fixes for a high-severity improper privilege management flaw in Secure Access Client for Windows that could be exploited to obtain System privileges. Tracked as CVE-2025-0320, the security defect was addressed in Secure Access Client for Windows version 25.5.1.15.
Another high-severity improper privilege management vulnerability, tracked as CVE-2025-4879, was addressed with the release of Citrix Workspace app for Windows version 2409, and in Workspace app for Windows 2402 LTSR CU2 Hotfix 1 and 2402 LTSR CU3 Hotfix 1.
Citrix makes no mention of any of these vulnerabilities being exploited in the wild, but users are advised to update their installations as soon as possible. Additional information can be found on the company’s security bulletins page.
Related: Citrix Warns of Password Spraying Attacks Targeting NetScaler Appliances
Related: Code Execution Vulnerabilities Patched in Veeam, BeyondTrust Products
Related: Chrome 137 Update Patches High-Severity Vulnerabilities
