The Dutch Nationwide Cyber Safety Centre (NCSC-NL) has warned of cyber assaults exploiting a not too long ago disclosed crucial security flaw impacting Citrix NetScaler ADC merchandise to breach organizations within the nation.
The NCSC-NL stated it found the exploitation of CVE-2025-6543 concentrating on a number of crucial organizations inside the Netherlands, and that investigations are ongoing to find out the extent of the impression.
CVE-2025-6543 (CVSS rating: 9.2) is a crucial security vulnerability in NetScaler ADC that leads to unintended management circulation and denial-of-service (DoS) when the units are configured as a Gateway (VPN digital server, ICA Proxy, CVPN, RDP Proxy) OR AAA digital server.
The vulnerability was first disclosed in late June 2025, with patches launched within the following variations –
- NetScaler ADC and NetScaler Gateway 14.1 previous to 14.1-47.46
- NetScaler ADC and NetScaler Gateway 13.1 previous to 13.1-59.19
- NetScaler ADC 13.1-FIPS and NDcPP previous to 13.1-37.236-FIPS and NDcPP
As of June 30, 2025, CVE-2025-6543 has been added to the U.S. Cybersecurity and Infrastructure Safety Company’s (CISA) Recognized Exploited Vulnerabilities (KEV) catalog. One other flaw in the identical product (CVE-2025-5777, CVSS rating: 9.3) was additionally positioned on the checklist final month.
NCSC-NL described the exercise as probably the work of a classy menace actor, including the vulnerability has been exploited as a zero-day since early Could 2025 – nearly two months earlier than it was publicly disclosed – and the attackers took steps to erase traces in an effort to hide the compromise. The exploitation was found on July 16, 2025.
“Throughout the investigation, malicious internet shells had been discovered on Citrix units,” the company stated. “An internet shell is a bit of rogue code that offers an attacker distant entry to the system. The attacker can place an internet shell by abusing a vulnerability.”
To mitigate the chance arising from CVE-2025-6543, organizations are suggested to use the newest updates, and terminate everlasting and energetic periods by operating the next instructions –
- kill icaconnection -all
- kill pcoipConnection -all
- kill aaa session -all
- kill rdp connection -all
- clear lb persistentSessions
Organizations also can run a shell script made accessible by NCSC-NL to hunt for indicators of compromise related to the exploitation of CVE-2025-6543.
“Recordsdata with a special .php extension in Citrix NetScaler system folders could also be a sign of abuse,” NCSC-NL stated. “Examine for newly created accounts on the NetScaler, and particularly for accounts with elevated rights.”
