US Edition
Netherlands: Citrix Netscaler flaw CVE-2025-6543 exploited to breach orgs
Sophisticated threat actors exploited the zero-day vulnerability since May 2025, breaching critical Dutch organizations and maintaining persistent access via malicious web shells, NCSC reported.
- The Dutch cybersecurity authority has alerted that attackers leveraged the critical Citrix NetScaler vulnerability CVE-2025-6543 to compromise several key organizations in the Netherlands by August 12, 2025.
- The zero-day vulnerability, a memory overflow flaw enabling remote code execution, was exploited since early May 2025 before Citrix publicly disclosed it on June 25, 2025.
- Investigations found malicious web shells on compromised Citrix devices, and NCSC-NL advised organizations to check for suspicious PHP files, new accounts, and elevated privileges as signs of compromise.
- Citrix released patches for vulnerable NetScaler ADC and Gateway versions before 14.1-47.46 and 13.1-37.236, while CISA urged immediate patching and mitigation steps including terminating active sessions.
- This incident highlights a sophisticated threat actor targeting critical infrastructure and emphasizes urgent patching and monitoring to prevent further exploitation and operational disruptions.
11 Articles
11 Articles
This article describes the causes and solutions for error code 521. This error is typically caused by Cloudflare and indicates that the target server is misconfigured or unable to respond correctly to requests. Common solutions include checking DNS settings, contacting the website administrator, or waiting for the server to return to normal.
State-Sponsored Hackers Exploit Citrix Zero-Day in Dutch Infrastructure Breach
In the quiet corridors of Dutch critical infrastructure, a sophisticated cyber assault has unfolded, exploiting vulnerabilities in Citrix NetScaler systems that have left security experts scrambling. The Netherlands’ National Cyber Security Centre (NCSC-NL) revealed this week that multiple key organizations—spanning sectors like energy, finance, and government—have been breached through a zero-day flaw tracked as CVE-2025-6543. This memory overf…
Netscaler vulnerability was exploited as zero-day for nearly two months (CVE-2025-6543) - Help Net Security
FortiGuard Labs has reported a dramatic spike in exploitation attempts targeting Citrix Bleed 2, a critical buffer over‑read flaw (CVE‑2025‑5777) affecting Citrix NetScaler ADC (Application Delivery Controller) and Gateway devices. Since July 28, 2025, they have detected over 6,000 exploitation attempts, mostly in the US, Australia, Germany and the UK, “with adversaries primarily focusing on high-value sectors such as technology, banking, health…
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
