Dutch NCSC: Citrix NetScaler zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-6543 | Memory Buffer Overflow in Citrix NetScaler ADC and Gateway Exploited in the Wild Citrix NetScaler ADC and NetScaler Gateway appliances contain a memory buffer overflow (CWE-119) that can lead to unintended control flow and denial of service. The flaw is only reachable when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server, and it is network-exploitable without authentication or user interaction, though attack complexity is rated high. A successful attacker could achieve unintended control flow — with the CVSS 4.0 vector rating impact high across confidentiality, integrity, and availability — or crash the appliance, disrupting VPN access and application delivery. Any organization running NetScaler ADC or NetScaler Gateway in an affected Gateway/AAA configuration is exposed, a population that public scan data places in the tens of thousands of internet-exposed devices. The vulnerability was added to CISA's KEV catalog on 2025-06-30, confirming exploitation in the wild, with EPSS at 10.1% and no public proof-of-concept known. Do: Apply the patched NetScaler release specified in Citrix's security bulletin for CVE-2025-6543 immediately, prioritizing appliances in Gateway or AAA configurations, per CISA KEV and BOD 22-01 requirements. Audit which virtual servers (VPN, ICA Proxy, CVPN, RDP Proxy, AAA) are in use and whether they are internet-exposed, and check appliances for signs of compromise before and after upgrading. | 9.2 | 10% | KEV |
| large≈50,000+ internet-exposed NetScaler ADC/Gateway devices (only Gateway/AAA configurations vulnerable) |
Full article426 words · extracted from securityaffairs.com · click to collapse
Dutch NCSC warns CVE-2025-6543 Citrix bug, a memory overflow flaw, is being exploited to breach critical organizations in the Netherlands.
The Dutch NCSC warns that the critical Citrix NetScaler flaw CVE-2025-6543 has been exploited to breach critical organizations in the Netherlands. Dutch NCSC experts pointed out that CVE-2025-6543 was exploited for remote code execution. Threat actors used the flaw to compromise multiple entities and erase evidence to hide the intrusions.
CVE-2025-6543 (CVSS score of 9.2) is a memory overflow vulnerability in NetScaler ADC and NetScaler Gateway when configured as a Gateway (e.g., VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
“Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server” reads the description of the flaw.
It can lead to unintended control flow and potentially cause a Denial of Service (DoS), disrupting service availability.
The flaw impacts the following supported versions of NetScaler ADC and NetScaler Gateway:
- NetScaler ADC and NetScaler Gateway 13.1 BEFORE 13.1-59.19
- NetScaler ADC 13.1-FIPS and NDcPP BEFORE 13.1-37.236-FIPS and NDcPP
- NetScaler ADC and NetScaler Gateway 14.1 BEFORE 14.1-47.46
At the end of June, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw CVE-2025-6543 to its Known Exploited Vulnerabilities (KEV) catalog.
“The NCSC has determined that several critical organizations in the Netherlands have been successfully attacked via a vulnerability with the characteristic CVE-2025-6543 in Citrix NetScaler.” reads the advisory published by the NCSC. “The NCSC identifies the attacks as the work of one or more actors using sophisticated methods. For example, the vulnerability was exploited as a zero-day vulnerability, and traces were actively erased to conceal the compromise at the affected organizations. The investigation is ongoing, but it can now be concluded that perhaps not all questions about this digital attack can be answered.”
NCSC says CVE-2025-6543 was exploited as a zero-day since early May. The Dutch Public Prosecution Service was hit, suffering major disruption until early August.
The NCSC urges organizations to increase their security posture by implementing defense-in-depth management measures. The agency has also released a detection script on GitHub that can scan devices for suspicious files.
“If Indicators of Compromise (IOCs) are found for this specific attack, further investigation is needed to determine whether a compromise has actually occurred. In that case, please contact [email protected] for further assistance.” concludes the Dutch agency.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CVE-2025-6543)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/181070/hacking/dutch-ncsc-citrix-netscaler-zero-day-breaches-critical-orgs.html