The Dutch National Cyber Security Center (NCSC-NL) is warning that a serious vulnerability in Citrix NetScaler ADC has been purposefully exploited to penetrate organizations. At issue is CVE-2025-6543, a vulnerability with a CVSS score of 9.2 that affects systems when NetScaler is set up as a Gateway or AAA server. Research indicates that the vulnerability has been exploited as a so-called zero-day since early May 2025, weeks before its public disclosure in late June. On July 16, the exploit was confirmed as Citrix released patches for branch 14.1 (as of 14.1-47.46), 13.1 (as of 13.1-59.19) and 13.1-FIPS/NDcPP (as of 13.1-37.236). The leak has been on the U.S. CISA's KEV list since June 30. In the same product line, CVE-2025-5777 (CVSS 9.3) has also been flagged as actively exploited.
According to the NCSC-NL, rogue webshells have been found on affected devices, which are pieces of code that give attackers backdoors to remotely execute commands and delete traces. Anyone deploying a NetScaler for VPN or application access is therefore at real risk of session hijacking, data theft and disruption of business processes.
Many organizations, from financial institutions to government and healthcare in Suriname, that have been allowed to use Citrix for remote and secure access, should know that a leak at this level can lead to service outages, reputational damage and reporting obligations to customers and partners. Avigdor, Suriname cybersecurity firm, recommends that organizations verify today that their NetScaler versions have been updated to the listed patch levels. After upgrading, invalidate all active sessions and enforce new login tokens; have system administrators explicitly terminate all gateway and AAA sessions and then rotate passwords and API keys. Check NetScaler system folders for unexpected .php files, see if administrator accounts have been created recently, and search logs for anomalous login locations. Whenever possible, Citrix access should be behind Multi-Factor Authentication, with source limitation on IP ranges and strict least-privilege roles.
Citizens and employees should remain alert to phishing and unusual MFA notifications. If you receive an unexpected request to confirm a login, refuse it and report it to the IT department immediately. If you work from home via a work VPN, update device and antivirus and change work-related passwords as soon as the organization requests it.
Avigdor stresses that rapid triage is critical from patching, session invalidation, securing log files and then a forensic check for backdoors. Organizations without their own SOC would be wise to outsource this to Avigdor and have a 72-hour recovery plan ready for network access, identity systems and critical applications. Those who need help with validation, log review or incident response can turn directly to Avigdor; we will provide a brief baseline measurement, close the leak, and assist with reporting and reinforcement of basic measures so that Surinamese companies can continue to operate safely.
