Sessionwright

Known exploited

CVE-2025-6543: what NetScaler® admins need to do

CVE-2025-6543 (buffer overflow) affects NetScaler ADC and Gateway. In CISA KEV since 2025-06-30. Fixed in 14.1-47.46 / 13.1-59.19. Check your build free.Added to CISA KEV . Last verified against CISA KEV and CVE.org.

Check your build for CVE-2025-6543Request an emergency upgrade

The short answer

Affected
NetScaler ADC and NetScaler Gateway builds below the first fixed build for their release, when the precondition below is met.
Fixed in
14.1-47.46 / 13.1-59.19First fixed builds for 14.1 / 13.1. All releases in the table below.
Current safe build
14.1-73.46 / 13.1-64.29Includes later fixes. Advisory data as of 2026-10-15.
CISA KEV
Added 2025-06-30, federal due date 2025-07-21. Known ransomware use: Unknown.
Forensic triage
No forensic triage flag on this KEV entry.
CVSS
9.2 (CVSS v4.0, vendor score in CTX694788)
Preconditions
Configured as Gateway or AAA virtual server
Session kill advised
No. The bulletin does not call for session termination. Community guidance recommends it (see After patching).

Fixed builds from the Citrix® security bulletin CTX694788

ReleaseFirst fixed buildCurrent safe build
NetScaler 14.114.1-47.4614.1-73.46
NetScaler 13.1Past end of maintenance13.1-59.1913.1-64.29
NetScaler 13.1 FIPS/NDcPPPast end of maintenance13.1-37.236 FIPS13.1-FIPS fix delivered via support13.1-37.283 FIPS
NetScaler 12.1 FIPS/NDcPPNot affected

FIPS and NDcPP builds have separate fixed builds: see the table and the bulletin.

What it is

“Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability”
Vulnerability name in the CISA Known Exploited Vulnerabilities catalog (catalog version 2026.10.15, product: NetScaler ADC and Gateway).

Our advisory data, taken from CTX694788, summarises it as: Memory overflow (vendor: DoS; exploited as RCE). Vulnerability class: buffer overflow (CWE-119). Precondition: Configured as Gateway or AAA virtual server.

For the full description, read the CVE.org record for CVE-2025-6543 and the vendor bulletin.

Am I affected?

Two things must both be true: the appliance runs a build below the fixed build for its release (see the table above), and its configuration meets the precondition: Configured as Gateway or AAA virtual server. Find the build with show ns version on the CLI.

Enter your build to check it against CVE-2025-6543 and every other NetScaler CVE in our data. The checker runs in your browser and never connects to any appliance.

Opens the free checker. It runs in your browser and never connects to any appliance.

Open the checker with CVE-2025-6543 highlighted

How to patch

  1. Choose the target build: at least 14.1-47.46 on 14.1 or 13.1-59.19 on 13.1. Prefer the current safe build (14.1-73.46 / 13.1-64.29), which also includes later fixes. FIPS and NDcPP appliances need their own fixed build from the table above.
  2. Upgrade every node. In an HA pair, upgrade the secondary first, fail over, then upgrade the former primary. Our HA pair upgrade runbook walks through each step and the rollback.
  3. Confirm the build on each node with show ns version, then work through the post-patch steps below.

13.1 is past end of maintenance, so plan the move to 14.1 while you are in the change window. Check the release dates in our NetScaler end-of-life guide.

Request an emergency upgradeSee how Nightpatch runs approval-gated upgrades

After patching

Steps in the vendor bulletin

vendor bulletin

The bulletin does not call for session termination. It lists no post-patch steps beyond the upgrade.

Additional steps from CISA, CERTs and researchers

community guidance
kill icaconnection -all
clear lb persistentSessions
  • kill icaconnection -all: NCSC-NL
  • clear lb persistentSessions: NCSC-NL

Run session kills only after every HA or cluster node is on the fixed build.

Hunt for compromise

Upgrading does not remove an existing compromise. These indicators and tools are published guidance; we do not run them for you.

  • NCSC-NL live-host, core-dump and disk-image checks

    • Atypical file dates
    • Duplicate file names with different extensions
    • Missing PHP files
    sh TLPCLEAR_check_script_cve-2025-6543-v1.8.sh   # writes /var/log/custom_checks_*.log

    Tools: NCSC-NL citrix-2025 (EUPL-1.2)

    Source: NCSC-NL

Work through the NetScaler post-patch checklist: session kills, IoC checks and evidence

Timeline

  1. Vendor bulletin CTX694788 published with fixed builds
  2. Added to the CISA Known Exploited Vulnerabilities catalog
  3. CISA federal remediation due date

Related CVEs

No other CVEs share this bulletin or a fixed build in our data.

Every exploited NetScaler CVE, newest first

Sources

Last verified 2026-10-15 against CISA KEV and CVE.org. Advisory data version 2026.10.15-1.

CVE-2025-6543: questions

Which NetScaler builds fix CVE-2025-6543?

Vendor bulletin CTX694788 fixes CVE-2025-6543 in 14.1-47.46 (NetScaler 14.1), 13.1-59.19 (NetScaler 13.1) and 13.1-37.236 FIPS (NetScaler 13.1 FIPS/NDcPP). NetScaler 12.1 FIPS/NDcPP is not affected. As of 2026-10-15, the current safe builds, which also include later fixes, are 14.1-73.46, 13.1-64.29 and 13.1-37.283 FIPS. FIPS and NDcPP builds have separate fixed builds.

Is CVE-2025-6543 exploited in the wild?

Yes. CISA added CVE-2025-6543 to the Known Exploited Vulnerabilities catalog on 2025-06-30, with a federal remediation due date of 2025-07-21. Known ransomware campaign use: Unknown.

Do I need to kill sessions after patching CVE-2025-6543?

The bulletin does not call for session termination. Community guidance recommends kill icaconnection -all and clear lb persistentSessions after every node is upgraded; it is labelled as community guidance on this page.

Check every appliance, not just one, for CVE-2025-6543

The free checker answers for one build in your browser. A read-only assessment covers your whole NetScaler estate and the Citrix environment behind it.

Check your NetScaler buildBook an assessment