Citrix Forgot to Tell You CVE-2025–6543 Has Been Used as a Zero Day Since May 2025

The disclosure around CVE-2025-6543 reveals that Citrix NetScaler appliances were exploited as a zero-day from at least May 2025, months before Citrix publicly acknowledged the flaw. Initially downplayed as a denial-of-service issue, the bug actually allowed remote code execution via crafted client certificates sent to the /cgi/api/login endpoint. Threat actors leveraged this to implant persistent web shells, steal credentials, and maintain access even after patching. Government and legal organizations worldwide were confirmed victims, with forensic evidence showing attackers deliberately erased traces to complicate investigations.

The same threat actor also leveraged CVE-2025-5777, known as CitrixBleed 2, to hijack user sessions, with evidence showing it too was exploited as a zero-day.