critical9.8Known exploited
CVE-2025-6543
Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2025-06-30. Federal due date: 2025-07-21.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Impact
Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Citrix | Netscaler Application Delivery Controller | from 13.1 before 13.1-37.236 from 13.1 before 13.1-59.19 from 14.1 before 14.1-47.46 |
| Citrix | Netscaler Gateway | from 13.1 before 13.1-59.19 from 14.1 before 14.1-47.46 |