CVE-2025-12101
Cross-Site Scripting (XSS)
At a glance Severity MEDIUM 5.9 EPSS EPSS 26.25 % · percentile 98 (2026-10-27) State PUBLISHED Published 2025-11-11 Updated 2025-11-12 Assigner Citrix NVD status Deferred Description Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
Scores Version Score Vector Scored by CVSS 4.0 MEDIUM 5.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L Citrix CVSS 4.0 MEDIUM 5.9 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X NVD · secure@citrix.com (Secondary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected products Product Versions NetScaler · ADC affected 14.1 < 56.73 ; affected 13.1 < 60.32 ; affected 13.1-FIPS and NDcPP < 37.250 ; affected 12.1-FIPS and NDcPP < 55.333 NetScaler · Gateway affected 14.1 < 56.73 ; affected 13.1 < 60.32 ; affected 13.1-FIPS and NDcPP < 37.250 ; affected 12.1-FIPS and NDcPP < 55.333
References
Sources
