Security advisories

Actively Exploited Citrix Vulnerability CVE-2025-6543

June 26, 2025 | 2 MINS READ

Speak With A Security Expert Now

TALK TO AN EXPERT

THE THREAT

On June 25th, 2025, Citrix disclosed a critical vulnerability identified as CVE-2025-6543 (CVSS score: 9.2), impacting NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). CVE-2025-6543 is a memory overflow vulnerability that could lead to unintended control flow and cause a Denial of Service (DoS) condition. Citrix has specified that successful exploitation requires the affected NetScaler appliances to be configured either as a Gateway (such as VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server.

CVE-2025-6543 has been confirmed to be actively exploited in the wild. Given the severity of this vulnerability, it is critical for organizations using affected versions of NetScaler ADC and NetScaler Gateway to immediately apply the relevant security patches to mitigate the risk of exploitation.

What we’re doing about it

What you should do about it

Additional information

NetScaler Application Delivery Controller (ADC) and NetScaler Gateway are network appliances serving different purposes. NetScaler ADC is designed to optimize, secure, and manage web application traffic. NetScaler Gateway is a remote access tool, providing Single Sign-On (SSO) and authentication for remote users accessing network resources, especially within Citrix environments. NetScaler ADC and NetScaler Gateway are widely adopted by organizations across both on-premises and cloud environments.

While Citrix confirmed that they have observed exploits for CVE-2025-6543, no technical details or Proof-of-Concept (PoC) exploit code have been publicly disclosed. Citrix has stated that Secure Private Access on-premises and hybrid deployments utilizing NetScaler instances are also impacted by the vulnerability. The disclosure of CVE-2025-6543 comes shortly after Citrix patched two other vulnerabilities in NetScaler ADC and NetScaler Gateway on June 17th, 2025.

Given the confirmed exploitation of CVE-2025-6543 and the history of threat actors rapidly leveraging Citrix vulnerabilities in past incidents, it is critical that organizations promptly apply the recommended patches and mitigations.

Impacted Versions List:

References:

[1] https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788
[2] https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420
[3] https://nvd.nist.gov/vuln/detail/CVE-2025-6543
[4] https://nvd.nist.gov/vuln/detail/CVE-2025-5777
[5] https://nvd.nist.gov/vuln/detail/CVE-2025-5349
[6] https://doublepulsar.com/citrixbleed-2-electric-boogaloo-cve-2025-5777-c7f5e349d206

 

View Most Recent Advisories