Netherlands: Citrix Netscaler flaw CVE-2025-6543 exploited to breach orgs

The Netherlands' National Cyber Security Centre (NCSC) is warning that a critical Citrix NetScaler vulnerability tracked as CVE-2025-6543 was exploited to breach "critical organizations" in the country. The critical flaw is a memory overflow bug that allows unintended control flow or a denial of service state on impacted devices. "Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server," explains Citrix's advisory. Citrix issued a bulletin about the flaw on June 25, 2025, warning that the following versions were vulnerable to ongoing attacks: While the flaw was initially thought to be exploited in denial of service (DoS) attacks, the NCSC's warning now indicates that the attackers exploited it to achieve remote code execution. The NCSC's warning about CVE-2025-6543 confirms that hackers have leveraged the flaw to breach multiple entities in the country, and then wiped traces of the attacks to eliminate evidence of the intrusions. "The NCSC has determined that multiple critical organizations in the Netherlands have been successfully attacked via a vulnerability identified as CVE-2025-6543 in Citrix NetScaler," reads the notice. "The NCSC assesses the attacks as the work of one or more actors with an advanced modus operandi. The vulnerability was exploited as a zero-day, and traces were actively removed to conce...