Over 28,000 Citrix Instances Vulnerable to Active 0-Day RCE Exploit Currently Under Attack
A critical zero-day remote code execution (RCE) vulnerability, tracked as CVE-2025-7775, affects over 28,000 Citrix instances globally. The flaw is actively exploited in the wild, prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to include it in its Known Exploited Vulnerabilities (KEV) catalog. As of August 26, 2025, the Shadowserver Foundation reported that more than 28,200 servers remain unpatched, with the highest concentrations of vulnerable systems located in the United States and Germany. Citrix has released patches and urges administrators to apply them immediately to prevent system compromise. The exploitation of this vulnerability poses a significant threat, allowing unauthenticated attackers to execute arbitrary code on affected servers, potentially leading to full system takeover, data theft, and further network infiltration.
CVE-2025-7775 represents one of the most severe security flaws, enabling remote attackers to run malicious code on vulnerable Citrix servers without needing any credentials. This level of access could allow threat actors to deploy ransomware, install backdoors for persistent access, exfiltrate sensitive corporate data, or use the compromised server as a pivot point to attack other systems within the network. The “zero-day” designation indicates that attackers exploited the flaw before Citrix made an official patch available, creating a critical window for compromise. Given the widespread use of Citrix products for secure remote access and application delivery in enterprise environments, the potential impact of this vulnerability is substantial. CISA’s confirmation of in-the-wild exploitation underscores the urgency for immediate action, mandating that U.S. Federal Civilian Executive Branch (FCEB) agencies patch their systems by a specified deadline, a directive that all organisations should follow.
Categories: Cybersecurity Vulnerability, Remote Code Execution, Patch Management
Tags: CVE-2025-7775, Remote Code Execution, Vulnerability, Citrix, Unauthenticated, Exploited, Patches, Cybersecurity, Threat Actors, Zero-Day