---
title: "Security Bulletin: Critical Vulnerability affecting Citrix NetScaler."
description: Critical Citrix NetScaler vulnerability (CVE-2025-6543) allows unauthenticated attackers to remotely exploit memory overflow and crash appliances. Actively exploited in the wild. Patch immediately to version 14.1-47.46 or later to mitigate risk.
---

[Cybersecurity Blog | RedLegg ](https://www.redlegg.com/blog)

# [Security Bulletin: Critical Vulnerability affecting Citrix NetScaler.](https://www.redlegg.com/blog/security-bulletin-critical-vulnerability-affecting-citrix-netscaler-adc-gateway-06-25)

 Written by [RedLegg's Cyber Threat Intelligence Team](https://www.redlegg.com/blog/author/redleggs-cyber-threat-intelligence-team) | 6/25/25 9:27 PM

About:

RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.

## VULNERABILITIES

### Citrix NetScaler ADC/Gateway Memory Overflow Denial-of-Service Vulnerability

 

**CVSS Score**: 9.2 (Critical)**  
****Identifier**: CVE-2025-6543**  
****Exploit or POC**: Yes – Actively exploited in the wild via unauthenticated remote requests  
**Update**: CVE-2025-6543 – [Citrix Security Advisory](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788)

**Description**: CVE-2025-6543 is a critical memory overflow vulnerability in Citrix NetScaler ADC and Gateway appliances. It affects configurations running as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. The flaw allows remote, unauthenticated attackers to send crafted requests that trigger a denial-of-service (DoS) by causing unintended control flow. Exploits have been observed in the wild, leading to appliances going offline.

Affected Versions:

- NetScaler ADC and Gateway 14.1 prior to 14.1-47.46
- NetScaler ADC and Gateway 13.1 prior to 13.1-59.19
- NetScaler ADC 13.1-FIPS and NDcPP prior to 13.1-37.236
- NetScaler ADC 12.1-FIPS and older end-of-life builds

**Mitigation Recommendation**:

Apply the Citrix patches immediately:

-  14.1 → Upgrade to 14.1-47.46 or later
- 13.1 → Upgrade to 13.1-59.19 or later
- 13.1-FIPS/NDcPP → Upgrade to 13.1-37.236 or later
- End-of-life versions: upgrade to supported versions without delay

 After patching, restart affected virtual servers or reboot appliances to clear any DoS state.

Restrict network access to Gateway and AAA virtual servers using firewalls or segmentation until patches are confirmed applied.

Monitor NetScaler logs and network traffic for unusual crash events or incoming malformed requests targeting proxy services.

* *

 

[View full post](https://www.redlegg.com/blog/security-bulletin-critical-vulnerability-affecting-citrix-netscaler-adc-gateway-06-25)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "RedLegg's Cyber Threat Intelligence Team"
  },
  "dateModified" : "2025-06-25T21:28:14.476Z",
  "datePublished" : "2025-06-25T21:27:18Z",
  "headline" : "Emergency Security Bulletin: Citrix NetScaler ADC/Gateway Memory Overflow Denial-of-Service Vulnerability",
  "image" : {
    "@type" : "ImageObject",
    "height" : 630,
    "url" : "https://www.redlegg.com/hubfs/Emergency%20Bulletin%20v2.png",
    "width" : 1200
  },
  "mainEntityOfPage" : "https://www.redlegg.com/blog/security-bulletin-critical-vulnerability-affecting-citrix-netscaler-adc-gateway-06-25",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/4675768/logo-red-01.png",
      "width" : 419.66666
    },
    "name" : "RedLegg Cybersecurity Blog"
  }
}
```