Risk Letters

Exploited vulnerability

CVE-2025-6543

TLP:CLEAR

Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability

Citrix NetScaler ADC and Gateway contain a buffer overflow vulnerability leading to unintended control flow and Denial of Service. NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.

Facts

  • Vendor: Citrix
  • Product: NetScaler ADC and Gateway
  • CVSS: 9.2
  • EPSS (probability of exploitation within 30 days): 10.4 %
  • On CISA's Known Exploited Vulnerabilities list since: 30 June 2025
  • First known exploitation: 30 June 2025
  • CISA's deadline for US federal agencies: 21 July 2025
  • Weakness: CWE-119
  • First seen by Risk Letters: 30 June 2025

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD