CVE-2025-6543: Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability

CVE-2025-6543 is a buffer overflow vulnerability in Citrix NetScaler ADC and Gateway. When the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server, an attacker can trigger the flaw to cause unintended control flow and denial of service. These appliances commonly sit at the network edge for remote access and authentication, so unpatched instances can disrupt availability of critical services. Confirm exact impact and fixed builds against the vendor advisory.

How it works

The weakness is classified as CWE-119 (improper restriction of operations within the bounds of a memory buffer). In a buffer overflow of this class, input that exceeds the size of an allocated buffer can overwrite adjacent memory. On NetScaler ADC and Gateway, successful abuse can alter control flow or crash the process, producing a denial-of-service condition. The CISA summary states the vulnerability is reachable only when the device is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server; other configurations are outside the documented scope. Specific exploit mechanics, required packets, or authentication requirements are not provided in the public summary and must be confirmed against the vendor advisory. No ransomware use is documented for this CVE.

Am I affected? How to find it in your systems

Citrix NetScaler ADC and Gateway appliances are typically deployed as reverse proxies, SSL VPN gateways, ICA/HDX proxies for Citrix Virtual Apps and Desktops, or AAA authentication front-ends. Inventory every NetScaler instance in your environment—physical, virtual, or cloud-hosted—and record its firmware version and feature configuration.

• Check the running configuration for Gateway virtual servers (VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual servers; only those configurations are listed as affected.
• Use the appliance CLI or management console to list virtual servers and confirm whether any match the Gateway or AAA roles described by CISA.
• Compare the installed build against the fixed versions published in the Citrix security bulletin for CVE-2025-6543; do not rely on version numbers from secondary sources.
• Review system and ns.log entries for unexpected process restarts, core dumps, or high CPU/memory spikes on the packet engine that coincide with external traffic to the Gateway or AAA listeners—these can be indicators of attempted exploitation, though they are not unique to this CVE.

If you operate NetScaler as a managed cloud service, also follow any applicable BOD 22-01 guidance for cloud services.

How to remediate

Patch first. Apply the vendor-supplied update or mitigation instructions published for CVE-2025-6543. After installing the fixed build, verify that the appliance reports the new version and that Gateway and AAA virtual servers continue to function as expected. CISA’s required action is to apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Once patched, harden the remaining attack surface for this class of memory-safety issues:

• Restrict management and data-plane access to trusted networks and authenticated clients only.
• Disable unused Gateway features (for example, RDP Proxy or CVPN) if they are not required.
• Keep the appliance firmware current and subscribe to Citrix security advisories so future memory-corruption fixes are applied promptly.

If you can't patch immediately

Until the vendor update can be installed, reduce exposure with compensating controls:

• Segment the NetScaler so that only necessary client networks can reach the Gateway or AAA virtual servers; block direct internet access where possible.
• Place a WAF or reverse-proxy layer in front of the appliance and enable any available virtual-patching rules for buffer-overflow or anomalous request patterns; confirm rule coverage with the WAF vendor.
• Temporarily disable non-essential Gateway modes (ICA Proxy, CVPN, RDP Proxy) or AAA virtual servers if business requirements allow.
• Increase monitoring of ns.log, SNMP traps, and external availability probes so that a crash or unexpected restart triggers an immediate alert and investigation.
• If mitigations cannot be applied and the risk is unacceptable, plan to discontinue use of the affected configuration until a fixed build is available.

If your data may have been exposed

Actively exploited edge vulnerabilities can lead to broader compromise even when the primary impact is denial of service. Review logs for signs of successful abuse, rotate any credentials that may have been handled by the appliance, and examine adjacent systems for lateral movement. You can run a free exposure scan of your email address to check whether it appears in known breach data sets and take further steps if matches are found.