CISA Adds Critical Citrix NetScaler Vulnerability to KEV Catalog

On June 30, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-6543, a critical buffer overflow vulnerability in Citrix NetScaler ADC and Gateway, to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation in the wild.

🔍 Vulnerability Overview

CVE ID: CVE-2025-6543
Vulnerability Type: Buffer Overflow
Affected Products:
- NetScaler ADC and Gateway appliances configured as:
  - VPN
  - ICA Proxy
  - Clientless VPN (CVPN)
  - RDP Proxy
  - AAA virtual server
Impact:
Successful exploitation may allow attackers to:
- Trigger unintended control flow, leading to potential remote code execution (RCE)
- Cause denial-of-service (DoS) by crashing or destabilizing the system
Exploitation Status:
- Actively exploited in the wild
- No known workarounds
- Affects Internet-facing NetScaler deployments, which are particularly at risk

🛡️ Official CISA Action

Added to KEV Catalog: June 30, 2025
Directive: Under Binding Operational Directive (BOD) 22-01, all Federal Civilian Executive Branch (FCEB) agencies are required to remediate the vulnerability by July 21, 2025.
Private Sector Implication: Although BOD 22-01 is limited to federal systems, CISA strongly urges all organizations using NetScaler to immediately patch vulnerable systems.

⚠️ Affected Versions (per Citrix Advisory)

Note: CVE-2025-6543 was disclosed alongside CVE-2025-5777, another critical issue. Both require immediate attention.

🧩 Technical Context

Buffer overflow flaws occur when software writes more data to a memory buffer than it can hold, potentially allowing:
- Execution of arbitrary code
- System crashes
- Bypassing of security mechanisms
In this case, improperly handled inputs in certain NetScaler services can be exploited remotely if the virtual server is accessible and improperly secured.

📌 Remediation Steps

Inventory all NetScaler ADC and Gateway deployments.
Check configuration: Identify whether they are acting as VPN/ICA Proxy/AAA/etc.
Review version numbers and immediately upgrade to the latest secure builds:
- Patch downloads are available from NetScaler’s Security Bulletin
Inspect logs for unusual activity or exploit attempts.
Apply network segmentation to isolate exposed services, if patching is delayed.
Continue monitoring CISA’s KEV Catalog for future updates.

🧠 Analyst Notes

This vulnerability is especially dangerous for enterprises that expose NetScaler services over the internet.
Exploits may be leveraged by APT groups or ransomware actors to gain access to sensitive networks.
The combination of buffer overflow and AAA proxying roles makes this a privileged attack surface.