CVE-2025-6543

Description

Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

Scoring

• CVSS: 9.8 (CRITICAL, 3.1)
• EPSS exploitation probability: Not yet available
• EPSS percentile: Not yet available

CISA KEV status

• Added to KEV: 2025-06-30
• Remediation due date: 2025-07-21
• Known ransomware campaign use: Unknown

Weakness types (CWE)

• CWE-119

References

• https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6543

More from Citrix

• CVE-2026-88779 — NetScaler
• CVE-2026-88771 — NetScaler
• CVE-2026-88772 — NetScaler
• CVE-2026-19490 — NetScaler
• CVE-2026-8452 — NetScaler ADC and NetScaler Gateway