U.S. CISA adds Citrix NetScaler flaw to its Known Exploited Vulnerabilities catalog – Source: securityaffairs.com

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Citrix NetScaler vulnerability to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Citrix NetScaler vulnerability, tracked as CVE-2025-6543, to its Known Exploited Vulnerabilities (KEV) catalog.

CVE-2025-6543 (CVSS score of 9.2) is a memory overflow vulnerability in NetScaler ADC and NetScaler Gateway when configured as a Gateway (e.g., VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

“Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server” reads the description of the flaw.

It can lead to unintended control flow and potentially cause a Denial of Service (DoS), disrupting service availability.

The flaw impacts the following supported versions of NetScaler ADC and NetScaler Gateway: 

• NetScaler ADC 13.1-FIPS and NDcPP  BEFORE 13.1-37.236-FIPS and NDcPP
• NetScaler ADC and NetScaler Gateway 14.1 BEFORE 14.1-47.46
• NetScaler ADC and NetScaler Gateway 13.1 BEFORE 13.1-59.19

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the vulnerabilities by July 21, 2025.

In January 2024, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) also added the following vulnerabilities in Citrix NetScaler to its Known Exploited Vulnerabilities (KEV) catalog.

• CVE-2023-6548 – Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability.
• CVE-2023-6549 – Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability.

Citrix warned customers to install security updates to address two actively exploited zero-day vulnerabilities, tracked as CVE-2023-6548 and CVE-2023-6549, impacting Netscaler ADC and Gateway appliances.

“Exploits of these CVEs on unmitigated appliances have been observed. Cloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible.” reads the advisory.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)