Citrix 0-Day Flaw Under Active Exploitation Since May

Security researchers have warned that CVE-2025-6543, a critical Citrix NetScaler vulnerability, has been exploited as a zero-day since at least early May 2025, enabling remote code execution through memory overflow attacks. The flaw, initially downplayed as a simple denial of service, has proven capable of compromising government and legal services worldwide, with a campaign that uses malicious client certificates sent to the NetScaler endpoint /cgi/api/login via hundreds of POST requests.

Citrix released patches on 25 June 2025, but threat actors reportedly had months to operate unpatched before the fix, according to investigations by NCSC Netherlands. Attacks have included deployment of persistent webshells and backdoors that remain active after patching, and the actors are exploiting multiple Citrix vulnerabilities simultaneously, including CVE-2025-5777 (CitrixBleed 2) to steal user sessions and bypass multi-factor authentication.

The crisis has highlighted broad systemic issues with NetScaler security, with some evidence suggesting internet-facing NetScaler devices have decreased by half since late 2023, and investigators warn that organisations may need to consider alternatives for remote access as they respond.