Citrix NetScaler Zero-Day Actively Exploited in the Wild

Citrix issued a security advisory on June 25 confirming that CVE-2025-6543, a vulnerability affecting NetScaler Application Delivery Controller (ADC) and NetScaler Gateway appliances, is being actively exploited in the wild. The vulnerability allows unauthenticated attackers to trigger a denial-of-service condition, causing affected devices to crash or become unresponsive.

This is the latest in a string of NetScaler vulnerabilities that have made the appliance a frequent target for threat actors. NetScaler ADC and Gateway sit at the network edge for thousands of enterprises, governments, and financial institutions — making them high-value targets for both criminal groups and state-sponsored actors.

The advisory follows a particularly heavy period for cybersecurity incidents. June 2025 saw major breaches at United Natural Foods, North Face, Cartier, Aflac, McLaren Health Care (743,000 patient records), and The Washington Post. The Scattered Spider group expanded its targeting from retail to insurance and aviation sectors. Iranian cyberattacks surged 133% in May-June compared to prior months.

For organizations running NetScaler, the guidance is straightforward: apply the patch immediately, restrict management interface access to trusted IPs, and monitor logs for anomalous traffic patterns. If patching isn't possible immediately, disable the affected features or place a WAF rule in front.

The broader pattern is that edge infrastructure appliances — VPN concentrators, load balancers, application firewalls — remain the soft underbelly of enterprise security. They're internet-facing, often under-monitored, and frequently run on outdated firmware.