Citrix bleeds again: This time a zero-day exploited - patch now

Hot on the heels of patching a critical bug in Citrix-owned Netscaler ADC and NetScaler Gateway that one security researcher dubbed "CitrixBleed 2," the embattled networking device vendor today issued an emergency patch for yet another super-serious flaw in the same products — but not before criminals found and exploited it as a zero-day. This new critical vulnerability, tracked as CVE-2025-6543, received a 9.2 severity score. It's a memory overflow vulnerability that can lead to unintended control flow and denial of service when the affected security appliances are configured as a gateway virtual server or an authentication, authorization, and accounting (AAA) virtual server. It affects: And, according to the vendor, miscreants exploited CVE-2025-6543 as a zero-day vulnerability before Citrix fixed the flaw. "Exploits of CVE-2025-6543 on unmitigated appliances have been observed," according to a security bulletin. Citrix did not respond to The Register's inquiries about the flaw, including how many devices have been compromised and what the intruders have done with their illicit access. According to watchTowr CEO Benjamin Harris, however, the 9.2 critical CVSS rating and the fact that it was exploited as a zero-day indicate that the miscreants abusing this hole are doing more than just denial-of-service (DoS) attacks. "The CVSS metrics reflect code execution or similar, not DoS as the most impactful outcome," Harris told The Register. "Vulnerable appliances being observed to...