What is the CVSS score of CVE-2025-6543?

CVE-2025-6543 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 2.0%.

Is there a public PoC exploit available for CVE-2025-6543?

Yes, a public proof-of-concept exploit is available for CVE-2025-6543. Prioritise patching immediately. EPSS: 2.0%.

How to fix or mitigate CVE-2025-6543?

Within 24 hours: Identify all NetScaler ADC and Gateway instances in production, especially those configured as VPN or AAA virtual servers, and isolate from internet-facing exposure pending patching. Within 7 days: Apply vendor-released security patch to all affected NetScaler systems; consult Citrix advisory for exact remediated versions. Within 30 days: Conduct forensic review of NetScaler access logs and authentication records dating back 90 days to identify potential compromise; validate no unauthorized VPN or administrative access occurred.

Netscaler Gateway CVE-2025-6543

Q: Which versions of Netscaler Gateway are affected by CVE-2025-6543?

Citrix NetScaler ADC and Gateway deployments are subject to confirmed active exploitation of a critical memory overflow vulnerability (CVE-2025-6543, CVSS 9.8) affecting VPN and authentication…. A patch is available.

EUVD-2025-19085 CRITICAL

Buffer Overflow (CWE-119)

2025-06-25 secure@citrix.com

Denial Of Service Citrix Netscaler Application Delivery Controller Netscaler Gateway

9.8

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-119 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, buffer size validation MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS 9.8 (Critical). KEV-listed — actively exploited. Public PoC available. No authentication required. DoS confirmed, RCE potential. Companion to CVE-2025-5777. NetScaler is critical infrastructure. EPSS 2.0%.
Exploit ScenarioDerived	An attacker sends crafted requests to the NetScaler VPN endpoint that trigger the memory overflow. In the DoS scenario, the overflow corrupts critical data structures, crashing the NetScaler and disconnecting all VPN users. In the RCE scenario, the attacker carefully controls the overflow to redirect execution to injected shellcode, gaining full control of the NetScaler appliance. Combined with CVE-2025-5777 for memory layout disclosure, exploitation reliability increases significantly.

Emergency Immediate action required. Why: In CISA KEV with patch available.

Exploited in the wild (CISA KEV) Patch available 2.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 15, 2026

Citrix NetScaler ADC and Gateway contain a memory overflow vulnerability (CVE-2025-6543, CVSS 9.8) leading to unintended control flow and denial of service when configured as VPN or AAA virtual server. KEV-listed with public PoC, this vulnerability paired with CVE-2025-5777 (memory overread) indicates a systemic weakness in NetScaler's VPN request processing that enables both data theft and remote code execution.

Earlier versions of this analysis (1)

v1 Mar 15, 2026 - 23:19 CVSS 9.8

NetScaler ADC and Gateway contain a memory overflow vulnerability (CWE-119) in VPN/AAA components that leads to unintended control flow, enabling denial of service and potentially remote code execution without authentication.

RemediationAI

Apply Citrix security update for both CVE-2025-6543 and CVE-2025-5777. Prioritize if VPN/AAA is internet-facing. Consider taking VPN offline if patching is delayed. After patching: invalidate sessions, rotate TLS keys.

Affected VersionsENISA

ADC 13.1 FIPS and NDcPP <37.236

ADC 14.1 <47.46

Gateway 13.1 <59.19

Gateway 14.1 <47.46

ADC 13.1 <59.19

Gateway 13.1 FIPS and NDcPP <37.236

Affected Packages

euvd adc fix: 47.46, 59.19

euvd adc_13_1_fips_and_ndcpp fix: 37.236

euvd gateway fix: 47.46, 59.19

euvd gateway_13_1_fips_and_ndcpp fix: 37.236

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 4 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Unlike the companion CVE-2025-5777 (memory overread for data theft), this vulnerability causes a memory overflow that corrupts control flow data. This can cause immediate denial of service (crashing the NetScaler) or, with careful exploitation, redirect execution to attacker-controlled code. The VPN/AAA functionality is the attack surface — the same components affected by the overread vulnerability, suggesting a shared root cause in request parsing.

Know when Netscaler Gateway gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

37.236,47.46,59.19

Added to CISA KEV

Oct 24, 2025 - 13:42 cisa

CISA KEV

EUVD Exploitation Confirmed

Oct 24, 2025 - 13:42 euvd

EUVD KEV

PoC Detected

Oct 24, 2025 - 13:42 vuln.today

Public exploit code

CVE Published

Jun 25, 2025 - 13:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

Executive ViewAI

Why It Matters

Citrix NetScaler ADC and Gateway deployments are subject to confirmed active exploitation of a critical memory overflow vulnerability (CVE-2025-6543, CVSS 9.8) affecting VPN and authentication services. This vulnerability enables remote attackers to achieve denial of service and potentially execute code without authentication, directly threatening organizational access control and data security for any organization using NetScaler as a perimeter security device.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If patch cannot be deployed immediately: restrict network access to NetScaler VPN and AAA virtual servers to known administrative IP ranges only; implement Web Application Firewall rules to block malformed VPN requests; increase authentication monitoring and anomaly detection for VPN sessions; consider temporary VPN service suspension until patched if risk tolerance is critical.

Threat Intelligence Overview

Threat Score

5.0/10

Composite threat intelligence

EPSS Score

2.0%

Top 16% exploitable

EUVD KEV

Listed

EU Exploited Vulnerability

Exploit

POC

Public exploit code exists

Data Quality

6 sources

Confidence: High

EUVD Citrix

NVD

CVE.org

CISA KEV

EPSS CERT-EU CIRCL

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV Yes

Public POC Yes

EPSS 2.0%

Patch available Yes

Active threat Yes

Deciding rule

In CISA KEV with patch available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Immediate

Exploitation· derived

Active

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

121

Low Medium High Critical

KEV: +50

EPSS: +2

CVSS: +49

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Netscaler Gateway

View all

CVE-2023-3519 CRITICAL Emergency POC

9.8 Jul 19

Citrix NetScaler ADC and Gateway contain an unauthenticated remote code execution vulnerability exploited massively in s

CVE-2023-4966 HIGH Act Now POC

7.5 Oct 10

Sensitive information disclosure in Citrix NetScaler ADC and NetScaler Gateway - widely known as 'Citrix Bleed' - allows

CVE-2025-5777 CRITICAL Act Now POC

9.3 Jun 17

Memory overread in Citrix NetScaler ADC and NetScaler Gateway (versions before 14.1-43.56 and 13.1-58.32) lets remote un

CVE-2026-19490 CRITICAL Emergency POC

9.3 Aug 19

Unauthenticated information disclosure in Citrix NetScaler ADC and NetScaler Gateway (versions 14.1 before 73.32 and 13.

CVE-2026-8452 HIGH Act Now POC

8.8 Jun 30

Denial of service and memory corruption in Citrix NetScaler ADC and NetScaler Gateway allows remote unauthenticated atta

CVE-2026-8451 HIGH This Week POC

8.8 Jun 30

Memory overread in Citrix NetScaler ADC and NetScaler Gateway lets remote attackers read out-of-bounds memory when the a

CVE-2025-5349 HIGH This Week POC

8.8 Jun 17

Improper access control vulnerability in NetScaler ADC and NetScaler Gateway management interfaces that allows unauthent

CVE-2023-4967 HIGH This Week POC

7.5 Oct 27

Denial of Service in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CV

CVE-2026-8655 HIGH This Week

8.8 Jun 30

Denial of service in Citrix NetScaler ADC and NetScaler Gateway stems from multiple memory overflow conditions that prod

CVE-2026-13474 HIGH This Week

8.7 Jun 30

Denial of service in Citrix NetScaler ADC and NetScaler Gateway allows remote attackers to crash or render unresponsive

CVE-2020-8247 HIGH This Week

8.8 Sep 18

Citrix ADC and Citrix Gateway 13.0 before 13.0-64.35, Citrix ADC and NetScaler Gateway 12.1 before 12.1-58.15, Citrix AD

CVE-2024-8534 HIGH This Week

8.4 Nov 12

Memory safety vulnerability leading to memory corruption and Denial of Service in NetScaler ADC and Gateway if the appli

Same weakness CWE-119 – Buffer Overflow

View all

CVE-2020-0796 CRITICAL POC

10.0

CVE-2017-11882 HIGH POC

7.8

CVE-2014-6332 HIGH POC

8.8

CVE-2015-2426 HIGH POC

8.8

CVE-2013-3918 HIGH POC

8.8

CVE-2017-11774 HIGH POC

7.8

CVE-2013-3660 HIGH POC

7.8

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-6543 ADVISORY https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788 REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-6543

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back