UpHeron
All vulnerabilities

Servers and applications

CVE-2025-6543

Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 30 Jun 2025.

Severity
Critical 9.2
Published
25 Jun 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
13.1-37.236, 13.1-59.19, 14.1-47.46
Sources
NVD

Affected software

SoftwareAffected versions
NetScaler ADC and GatewayServers and applications · cpe:a:citrix:netscaler_application_delivery_controller
  • From 13.1 before 13.1-37.236
  • From 13.1 before 13.1-59.19
  • From 14.1 before 14.1-47.46
NetScaler ADC and GatewayServers and applications · cpe:a:citrix:netscaler_gateway
  • From 13.1 before 13.1-59.19
  • From 14.1 before 14.1-47.46

Known exploited

CISA name
Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due for US agencies
21 Jul 2025
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-6543
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-6543