Summary:

Citrix has released emergency patches addressing two critical vulnerabilities—CVE-2025-6543 and CVE-2025-5777—affecting NetScaler ADC and NetScaler Gateway appliances. These vulnerabilities can lead to denial-of-service and remote code execution in certain configurations and are being actively exploited in the wild. Given the widespread use of these solutions in enterprise environments, the flaws present a significant threat to operational integrity and security.

Threat Alert: Citrix has released emergency patches addressing two critical vulnerabilities—CVE-2025-6543 and CVE-2025-5777—affecting NetScaler ADC and NetScaler Gateway appliances.

Risks:

  • CVE-2025-6543: This is a memory corruption issue leading to unintended control flow. Exploitation may result in denial-of-service or other undefined behaviors when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. The vulnerability has a CVSS score of 9.2 and has been observed in active exploitation campaigns, primarily targeting externally accessible systems.

  • CVE-2025-5777: This vulnerability allows an attacker to execute arbitrary code under certain conditions. Unlike CVE-2025-6543, it is triggered through malicious traffic patterns that exploit input handling in the affected Citrix components. The threat level is high due to the potential for full system compromise.

Affected Versions:

  • CVE-2025-6543:

    • NetScaler ADC and Gateway 14.1 before 14.1-47.42

    • NetScaler ADC and Gateway 13.1 before 13.1-58.15

    • NetScaler ADC and Gateway 13.0 before 13.0-92.21

    • NetScaler ADC 13.1-FIPS before 13.1-37.176

    • NetScaler ADC 12.1-FIPS before 12.1-55.302

    • NetScaler ADC 12.1-NDcPP before 12.1-55.302

Note: CVE-2025-5777 affects overlapping product lines and versions, though detailed versioning specifics were not provided.

Remediation:

Citrix urges immediate upgrades to the patched versions listed below:

  • NetScaler ADC and Gateway 14.1-47.42 or later

  • NetScaler ADC and Gateway 13.1-58.15 or later

  • NetScaler ADC and Gateway 13.0-92.21 or later

  • NetScaler ADC 13.1-FIPS 13.1-37.176 or later

  • NetScaler ADC 12.1-FIPS/NDcPP 12.1-55.302 or later

For systems running unsupported or end-of-life versions, upgrading to a supported release is essential. Additionally, organizations should implement network segmentation to isolate public-facing gateways and enable logging to monitor for suspicious activity.

Conclusion:

The discovery and active exploitation of CVE-2025-6543 and CVE-2025-5777 underscore the importance of maintaining up-to-date Citrix infrastructure. These vulnerabilities are severe and can lead to system downtime or full system compromise if not addressed. Organizations should apply the patches immediately and assess their exposure to ensure no vulnerable assets remain accessible.