NetScaler security vulnerability
We want to inform you about a recently disclosed security vulnerability affecting NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) identified as CVE-2025-5777. And also CVE-2025-6543 which is a memory overflow vulnerability that could lead to Denial Of Service.
Vulnerability summary:
- https://nvd.nist.gov/vuln/detail/CVE-2025-5777 is a critical flaw that is caused by out-of-bounds memory read, allowing unauthenticated attacks to access portions of memory that they should not have access to.
- https://nvd.nist.gov/vuln/detail/CVE-2025-6543 is a critical flaw impacting NetScaler ADC and NetScaler Gateway and can be triggered by unauthenticated, remote requests, leading the appliance to go offline.
Affected versions:
The following supported versions of NetScaler ADC and NetScaler Gateway are affected by the vulnerabilities:
- NetScaler ADC and NetScaler Gateway 14.1 BEFORE 14.1-43.56
- NetScaler ADC and NetScaler Gateway 13.1 BEFORE 13.1-58.32
- NetScaler ADC 13.1-FIPS and NDcPP BEFORE 13.1-37.235-FIPS and NDcPP
- NetScaler ADC 12.1-FIPS BEFORE 12.1-55.328-FIPS
Recommended action:
Citrix has released updates and mitigations for this vulnerability.
We strongly recommend to do what Citrix describes on their website.
- Review your Netscaler version and deployment.
- Apply the relevant security updates as soon as possible.
- Review access logs for unusual behavior.
More information:
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX693420
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694788