Loading story…
Citrix disclosed CVE-2025-6543, a critical memory overflow vulnerability in NetScaler ADC and NetScaler Gateway that affects devices configured as a Gateway or AAA virtual server. The flaw can trigger unintended control-flow redirection and service disruption, leading to denial of service, and was assigned a CVSS v4.0 score of 9.2. Affected releases include NetScaler ADC and Gateway 14.1 before 14.1-47.46, 13.1 before 13.1-59.19, and NetScaler ADC 13.1-FIPS/NDcPP before 13.1-37.236-FIPS/NDcPP; Citrix also said Secure Private Access on-prem and hybrid deployments using NetScaler instances are impacted.
Citrix directed customers to upgrade immediately to fixed builds or discontinue use where no supported update is available, with the issue tracked in Citrix advisory CTX694826 and the CVE record CVE-2025-6543. Follow-on guidance warned that upgrading to 14.1-47.46 or 13.1-59.19 may introduce authentication problems, including broken login pages in environments using DUO or SAML, and the company published remediation steps for affected deployments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Citrix later reported that upgrading to versions 14.1-47.46 or 13.1-59.19 could introduce authentication problems, including broken login pages, particularly in environments using DUO or SAML. The company provided remediation guidance for affected deployments.
Citrix recommended immediate upgrades to fixed versions, including 14.1-47.46, 13.1-59.19, and 13.1-37.236-FIPS/NDcPP for affected NetScaler deployments. It also advised discontinuing use where no update was available.
Citrix disclosed CVE-2025-6543, a critical memory overflow vulnerability affecting NetScaler ADC and NetScaler Gateway when configured as a Gateway or AAA virtual server. The flaw can cause unintended control-flow redirection and service disruption leading to denial of service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citrix published a security advisory for **NetScaler ADC** and **NetScaler Gateway**, warning that multiple high-severity vulnerabilities can be exploited remotely in specific deployments and configurations. The advisory, highlighted by the Canadian Centre for Cyber Security, affects the `14.1` and `13.1` release lines as well as certain **NetScaler FIPS** and **NDcPP** editions, and references six CVEs including `CVE-2026-8451`, `CVE-2026-8452`, `CVE-2026-8655`, and `CVE-2026-13474`. Administrators were urged to review Citrix’s bulletin and move affected systems to fixed versions. The disclosed flaws include a malformed HTTP/2 request issue that can trigger denial of service when HTTP/2 is enabled on affected LB, CS, VPN virtual servers or services (`CVE-2026-13474`); multiple memory overflow vulnerabilities tied to Oracle load balancer, DNS proxy, and DNS recursive resolver deployments (`CVE-2026-8655`); a memory overread caused by insufficient input validation when NetScaler is configured as a **SAML Identity Provider** (`CVE-2026-8451`); and a separate memory overflow vulnerability affecting **Gateway** or **AAA** virtual servers, including **SSL VPN**, **ICA Proxy**, **CVPN**, and **RDP Proxy** deployments (`CVE-2026-8452`). Recommended mitigations include applying Citrix security updates, disabling HTTP/2 or vulnerable Gateway features where not required, reviewing exposed virtual server and HTTP profile configurations, and monitoring for anomalous behavior.
Jul 1, 2026
Citrix released security updates to address multiple vulnerabilities affecting **Citrix XenServer**, **NetScaler ADC**, and **NetScaler Gateway**, warning that the flaws could lead to denial-of-service conditions, memory corruption, disclosure of sensitive information, arbitrary code execution, and unauthorized access. The update was highlighted by EG-FinCIRT, which said organizations should apply the fixes after completing testing. The most prominent issues are **`CVE-2026-8451`** and **`CVE-2026-8452`**, both affecting NetScaler ADC and NetScaler Gateway and each assigned a **CVSS 4.0 score of 8.8**. EG-FinCIRT described `CVE-2026-8451` as an insufficient input validation flaw and `CVE-2026-8452` as a race condition vulnerability, underscoring the risk to internet-facing Citrix infrastructure commonly used for application delivery and remote access.
Jul 14, 2026
Citrix released security updates for NetScaler ADC and NetScaler Gateway to fix multiple vulnerabilities, led by **CVE-2025-5777**, a critical out-of-bounds read flaw dubbed **"Citrix Bleed 2"** because of its similarity to the 2023 Citrix Bleed bug. The vulnerability affects NetScaler deployments used as a Gateway or virtual AAA server and can let a remote unauthenticated attacker read memory, steal sensitive data such as credentials and configuration, hijack sessions, bypass MFA, and potentially gain broader control of affected systems. Citrix and third-party reporting also highlighted **CVE-2025-6543**, a denial-of-service flaw reported as actively exploited, and **CVE-2025-5349**, a high-severity improper access control issue in the NetScaler Management Interface that could allow unauthorized access from the same network segment. Security researchers reported signs consistent with real-world exploitation of **CVE-2025-5777** for initial access, including hijacked Citrix web sessions reused across multiple IP addresses, LDAP-based Active Directory reconnaissance, and use of **ADExplorer64.exe** against multiple domain controllers. Citrix urged administrators to upgrade affected versions immediately, including NetScaler ADC and Gateway `14.1` before `14.1-43.56`, `13.1` before `13.1-58.32`, `13.1-FIPS/NDcPP` before `13.1-37.235-FIPS/NDcPP`, and `12.1-FIPS` before `12.1-55.328-FIPS`, while noting older `12.1` and `13.0` branches are end-of-life. The company also recommended terminating active ICA and PCoIP sessions after patching HA pairs or clusters and monitoring for anomalous HTTP activity associated with session theft.
Jul 24, 2026