Digest · Tuesday

Security digest: June 17, 2025

1 editorial brief, 1 known exploited (cisa kev) addition and 1 critical advisory.

All digests · RSS · Markdown

Take stock

Check exposure: Citrix Bleed 2. Operators of customer-managed NetScaler ADC or Gateway configured as a Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server that were below the fixed builds in mid-2025.
Do you run any of these? Linux Kernel. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-07-08.
PyPI: 1 critical advisory (langflow, langflow-base). Check with pip-audit (or: pip show <package>).
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

Jun 17, 2025 · Vulnerability · CVE-2025-5777, CVE-2025-6543

Citrix Bleed 2: NetScaler Gateway Memory Leak

A pre-auth memory leak on internet-facing VPN gateways that was exploited within weeks; patched since June 2025, so the job now is proving you patched, killed sessions and were not session-hijacked.

Must act: Operators of customer-managed NetScaler ADC or Gateway configured as a Gateway (VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server that were below the fixed builds in mid-2025.

Can relax: Citrix-managed cloud services customers (updated by the vendor) and appliances not configured as a Gateway or AAA virtual server that are on current builds.

Confirm every NetScaler node runs at least 14.1-47.46 or 13.1-59.19 (covers both CVE-2025-5777 and CVE-2025-6543) with show version.
After patching, run kill icaconnection -all and kill pcoipConnection -all on the HA primary or on every cluster node.
Review Gateway and AAA session logs from June-July 2025 for sessions reused from multiple IPs or from hosting-provider ranges.

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVE	Product and flaw	CISA due
CVE-2023-0386	Linux Kernel Linux Kernel Improper Ownership Management Vulnerability	2025-07-08

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

PyPI 1

Check: pip-audit (or: pip show <package>)

Langflow Unauth RCE CVE-2025-3248 CVSS 9.3 Critical
langflow < 1.3.0 → fixed in 1.3.0; langflow-base < 0.3.0 → fixed in 0.3.0