DaystoPatch

CitrixExploited incident

NetScaler ADC and Gateway memory overflow exploited as a zero-day (June 2025)

CVE-2025-6543Critical, CVSS 9.2In CISA's Known Exploited Vulnerabilities catalog since 30 Jun 2025

  • Exploited before a fix
FixedFixed for every supported version on the day it became public.
Embed this live clock

Response

Silence
0h
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    CVE record CVE-2025-6543 (CNA: NetScaler)CuratedQuote verified

    "datePublished":"2025-06-25T12:49:57.896Z"

    Citrix's disclosure, which already said exploits had been observed, is the earliest public signal found. Later secondary reporting (Dutch NCSC) put exploitation back to early May 2025; not verified here.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5a33505dd89a9973…
    Used in metrics
    Yes
    Dispute this timestamp
    7 more sources for this moment
    Citrix advisory CTX694788ClaimedQuote verified25 Jun 2025

    NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2025-6543

    The vendor's own disclosure.

    Source
    Citrix advisory CTX694788 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f379c1eb8498264d…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Citrix bulletin CTX694788CuratedQuote verified25 Jun 2025

    Exploits of CVE-2025-6543 on unmitigated appliances have been observed.

    Source
    Citrix bulletin CTX694788 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f379c1eb8498264d…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2025-6543ClaimedQuote verified25 Jun 2025, 12:49 UTC

    Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5a33505dd89a9973…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet25 Jun 2025, 12:53 UTC

    You can now share your thoughts on vulnerability CVE-2025-6543 in Vulnerability-Lookup:

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet25 Jun 2025, 18:16 UTC

    Citrix's NetScaler is under fire—a memory overflow flaw (CVE-2025-6543) lets attackers trigger DoS without any authentication. Are your systems patched and ready for this critical threat? https:// thedefendopsdiaries.com/citrix -n

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2025-6543)ClaimedQuote verified30 Jun 2025

    Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability

    Added to CISA's KEV catalog on 2025-06-30.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Hacker NewsClaimedQuote not checked yet28 Aug 2025, 19:38 UTC

    https://doublepulsar.com/citrix-forgot-to-tell-you-cve-2025-6543-has-been-used-as-a-zero-day-since-may-2025-d76574e2dd2c

    Earliest third-party post we hold.

    Source
    Hacker News hn
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    CVE record CVE-2025-6543 (CNA: NetScaler)CuratedQuote verified

    "datePublished":"2025-06-25T12:49:57.896Z"

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5a33505dd89a9973…
    Used in metrics
    Yes
    Dispute this timestamp
    2 more sources for this moment
    Citrix advisory CTX694788ClaimedQuote verified25 Jun 2025

    NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2025-6543

    Source
    Citrix advisory CTX694788 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f379c1eb8498264d…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Citrix bulletin CTX694788CuratedQuote verified25 Jun 2025

    2025-06-25 Initial Publication

    Source
    Citrix bulletin CTX694788 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f379c1eb8498264d…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Citrix bulletin CTX694788CuratedQuote verified

    NetScaler ADC and NetScaler Gateway 14.1-47.46 and later releases

    Only later changelog entry (2025-06-27) adds a blog link.

    Source
    Citrix bulletin CTX694788 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f379c1eb8498264d…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Citrix bulletin CTX694788CuratedQuote verified

    Customers should contact support - https://support.citrix.com/support-home/home to obtain the 13.1-FIPS and 13.1-NDcPP builds that address this issue.

    14.1, 13.1 and 13.1-FIPS/NDcPP fixes at publication (FIPS/NDcPP builds via support). Non-FIPS 12.1 and 13.0 are end of life.

    Source
    Citrix bulletin CTX694788 vendor advisory
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:f379c1eb8498264d…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

NetScaler zero-day memory overflow exploited before fix released Jun 25, 2025

Attackers were exploiting a critical NetScaler memory overflow before Citrix released fixed builds on 25 June 2025.

In plain words

Citrix NetScaler remote access gateways had a critical flaw that attackers were using before Citrix released a fix on 25 June 2025. If we run NetScaler, it must be on a fixed version, and because attacks started before the fix, we should check the devices for signs of an earlier break-in.

What happened and who is affected

What happened

On 25 June 2025 Citrix published bulletin CTX694788 for CVE-2025-6543, a memory overflow in NetScaler ADC and Gateway that can cause unintended control flow or denial of service on appliances configured as a Gateway or AAA virtual server, and said exploits had been observed. Fixed builds were released the same day.

Who is affected

Customer-managed NetScaler ADC and Gateway 14.1 before 14.1-47.46, 13.1 before 13.1-59.19 and 13.1-FIPS/NDcPP before 13.1-37.236, configured as a Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. 12.1 and 13.0 are end of life.

CVE-2025-6543. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/citrix-cve-2025-6543/

Affected products

  • NetScaler ADC
  • NetScaler Gateway
  • NetScaler ADC FIPS and NDcPP
How we built this timeline

Zero-day: exploitation stated in the initial bulletin. Secondary reporting (Dutch NCSC, August 2025; not fetched or verified here) says exploitation from early May 2025 against Dutch critical organisations.

CVSS v4.0 9.2. Bulletin changelog: 25 Jun 2025 initial publication; 27 Jun 2025 blog link added.

Related

Citrix report card