{"id":"CVE-2025-6543","published":"2025-06-25T13:15:27Z","modified":"2026-06-17T10:02:07Z","title":"Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability","vendor":"Citrix","product":"NetScaler ADC and Gateway","tier":"core","eol":null,"description":{"text":"Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server","provenance":"source","from":"NVD"},"summary":{"text":"The buffer overflow vulnerability lies in Citrix NetScaler ADC and NetScaler Gateway, specifically in the component that handles memory operations within the bounds of a memory buffer. An unauthenticated remote attacker over the network, requiring no user interaction, can trigger the memory overflow to hijack control flow or cause a denial of service, but only when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:12:26Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.10433,"percentile":0.95725,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-06-30","dueDate":"2025-07-21","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788 ; https://www.netscaler.com/blog/news/netscaler-critical-security-updates-for-cve-2025-6543-and-cve-2025-5777/ ;   https://nvd.nist.gov/vuln/detail/CVE-2025-6543","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-06-25","exploitedFirstSeen":"2025-06-25","ransomware":false,"evidence":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788","date":"2025-06-25"},{"url":"https://reliaquest.com/blog/threat-spotlight-citrix-bleed-2-vulnerability-in-netscaler-adc-gateway-devices/","date":"2025-06-26"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-06-30"},{"url":"https://labs.watchtowr.com/how-much-more-must-we-bleed-citrix-netscaler-memory-disclosure-citrixbleed-2-cve-2025-5777/","date":"2025-07-04"},{"url":"https://www.ncsc.nl/actueel/nieuws/2025/07/21/informatie-over-kwetsbaarheden-in-citrix-netscaler-adc-en-netscaler-gateway","date":"2025-07-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2025-07-30&host_type=src&vulnerability=cve-2025-6543","date":"2025-07-30"},{"url":"https://fortiguard.fortinet.com/outbreak-alert/citrix-bleed-2","date":"2025-08-06"},{"url":"https://www.ncsc.nl/actueel/nieuws/2025/07/22/casus-citrix-kwetsbaarheid","date":"2025-08-11"},{"url":"https://doublepulsar.com/citrix-forgot-to-tell-you-cve-2025-6543-has-been-used-as-a-zero-day-since-may-2025-d76574e2dd2c","date":"2025-08-28"},{"url":"https://doublepulsar.com/citrix-netscaler-backdoors-part-one-may-2025-activity-against-governments-f48037199c3f","date":"2025-09-01"}],"evidenceTotal":21,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}],"references":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6543","tags":["US Government Resource"]}],"techniques":[{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"exploitation_technique","evidence":[],"comment":"An unprivileged attacker can leverage this buffer overflow vulnerability, leading to a denial of service attack. No public exploits of this vulnerability exist, and information from Citrix is limited.","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1498","name":"Network Denial of Service","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"primary_impact","evidence":[],"comment":"An unprivileged attacker can leverage this buffer overflow vulnerability, leading to a denial of service attack, and potentially remote code execution. No public exploits of this vulnerability exist, and information from Citrix is limited.","confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"secondary_impact","evidence":[],"comment":"An unprivileged attacker can leverage this buffer overflow vulnerability, leading to a denial of service attack, and potentially remote code execution. No public exploits of this vulnerability exist, and information from Citrix is limited.","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-19085","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-19085","exploited":true,"exploitedSince":"2025-06-30","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2025-06-26","earliestUrl":"https://github.com/grupooruss/Citrix-cve-2025-6543","repos":[{"name":"abrewer251/CVE-2025-6543_CitrixNetScaler_PoC","url":"https://github.com/abrewer251/CVE-2025-6543_CitrixNetScaler_PoC","stars":6,"created":"2025-07-03"},{"name":"grupooruss/Citrix-cve-2025-6543","url":"https://github.com/grupooruss/Citrix-cve-2025-6543","stars":5,"created":"2025-06-26"},{"name":"lex1010/CVE-2025-6543","url":"https://github.com/lex1010/CVE-2025-6543","stars":0,"created":"2025-06-30"}]},"first":{"date":"2025-06-26","source":"PoC-in-GitHub","url":"https://github.com/grupooruss/Citrix-cve-2025-6543"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"primary","techniques":["T1498"],"provenance":"source"},{"stage":"secondary","techniques":["T1059"],"provenance":"source"},{"stage":"related","techniques":["T1203"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2025-06-25","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6543","provenance":"source"},{"date":"2025-06-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788","provenance":"source"},{"date":"2025-06-26","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/grupooruss/Citrix-cve-2025-6543","provenance":"source"},{"date":"2025-06-30","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-06-30","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-19085","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"PoC-in-GitHub","daysToKev":5},"priority":{"score":69.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 492 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.14,"detail":"percentile 0.9573"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}