CVE-2025-6543

Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

CVSS v4.0

9.2 CRITICALCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

10.09% chance of exploitation in the next 30 days, 95th percentile

CISA KEV

added 2025-06-30

Published

2025-06-25

Updated

2026-02-26

Proof-of-concept exploits (4)

• abrewer251/CVE-2025-6543_CitrixNetScaler_PoC6★ · 2025-07-03
• grupooruss/Citrix-cve-2025-65435★ · 2025-06-26
• lex1010/CVE-2025-65430★ · 2025-06-30
• mingshenhk/CitrixBleed-2-CVE-2025-5777-PoC-17★ · 2025-06-30

References

• CVE Record
• NVD entry

Related

• CVE-2017-12637
• CVE-2020-1938
• CVE-2020-3452
• CVE-2022-22536
• CVE-2024-21762
• CVE-2024-38475