Added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on June 30, 2025, threat actors are actively exploiting this high-severity flaw and pose significant risks to organizations utilizing these network infrastructure components. The vulnerability enables attackers to achieve unintended control flow manipulation and execute Denial-of-Service (DoS) attacks against affected systems, prompting immediate action from federal agencies and private sector organizations. The urgent nature of this vulnerability underscores the critical importance of maintaining current patch levels for network infrastructure components and implementing robust vulnerability management programs across enterprise environments. CISA has issued an urgent warning regarding a critical buffer overflow vulnerability in Citrix NetScaler ADC and Gateway products, designated as CVE-2025-6543. CVE-2025-6543 represents a buffer overflow vulnerability classified under the Common Weakness Enumeration (CWE) 119, which encompasses the improper restriction of operations within memory buffer boundaries. The buffer overflow condition occurs during packet processing routines, where malformed network traffic can trigger memory corruption, leading to system instability or complete compromise. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. While CISA’s current assessment indicates the vulnerability’s use in ransomware campaigns remains unknown, the active exploitation status suggests sophisticated threat actors are leveraging this flaw for malicious purposes. Affected systems must be configured as Gateway services, including VPN virtual servers, ICA Proxy implementations, CVPN (Cloud VPN) services, or RDP Proxy configurations. This directive follows Binding Operational Directive (BOD) 22-01 guidelines, which mandate federal agencies to address known exploited vulnerabilities within specified timeframes. The exploitation of this flaw can result in arbitrary code execution and system compromise, making it particularly dangerous for internet-facing network appliances. Additionally, systems configured with AAA (Authentication, Authorization, and Accounting) virtual servers are susceptible to this vulnerability. Organizations must immediately apply security updates released by Citrix and follow guidance to protect against ongoing threats. Kaaviya is a Security Editor and fellow reporter with Cyber Security News.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 01 Jul 2025 08:50:13 +0000