Citrix · NetScaler ADC and Gateway
CVE-2025-6543
Memory overflow vulnerability leading to unintended control flow and Denial of Service
Cos'è
Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
CISA: Citrix NetScaler ADC and Gateway contain a buffer overflow vulnerability leading to unintended control flow and Denial of Service. NetScaler must be configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.
Cosa fare
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Scadenza per le agenzie federali USA: 21 luglio 2025
Altre falle sfruttate di Citrix
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 10 lug 2025 | Out-of-Bounds Read | NetScaler ADC and Gateway | Critica 9,3 | >99,9% |
| 4 ott 2026 | Improper Restriction of Operations within the Bounds of a Memory Buffer | NetScaler | Alta 8,7 | 11% |
| 27 set 2026 | Improper Input Validation | NetScaler | Critica 9,5 | 82% |
| 27 set 2026 | Improper Restriction of Operations within the Bounds of a Memory Buffer | NetScaler | Critica 9,5 | 78% |
| 9 set 2026 | Authentication Bypass Using an Alternate Path or Channel | NetScaler | Critica 9,3 | 33% |
| 26 ago 2026 | Improper Restriction of Operations within the Bounds of a Memory Buffer | NetScaler ADC and NetScaler Gateway | Alta 8,8 | 1,0% |
| 30 mar 2026 | Out-of-Bounds Read | NetScaler | Critica 9,3 | 91% |
| 26 ago 2025 | Memory Overflow | NetScaler | Critica 9,2 | 21% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.