CVE-2025-8424

Improper access control on the NetScaler Management Interface

At a glance

Severity: HIGH 8.7
EPSS: EPSS 3.73 % · percentile 90 (2026-10-27)
State: PUBLISHED
Published: 2025-08-26
Updated: 2026-02-26
Assigner: Citrix
NVD status: Deferred

Description

Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway when an attacker can get access to the appliance NSIP, Cluster Management IP or local GSLB Site IP or SNIP with Management Access

Scores

Version	Score	Vector	Scored by
CVSS 4.0	HIGH 8.7	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L	Citrix
CVSS 4.0	HIGH 8.7	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · secure@citrix.com (Secondary)

Weaknesses (CWE)

CWE-1284

European references

ENISA EUVD · EUVD-2025-25868
GCVE · GCVE-0-2025-8424

CERT-FR advisories

CERTFR-2025-AVI-0730 — Multiples vulnérabilités dans Citrix NetScaler ADC et NetScaler Gateway · cert.ssi.gouv.fr

Affected products

Product	Versions
NetScaler · ADC	affected 14.1 < 47.48 ; affected 13.1 < 59.22 ; affected 13.1 FIPS and NDcPP < 37.241 ; affected 12.1 FIPS and NDcPP < 55.330
NetScaler · Gateway	affected 14.1 < 47.48 ; affected 13.1 < 59.22 ; affected 13.1 FIPS and NDcPP < 37.241 ; affected 12.1 FIPS and NDcPP < 55.330

References

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD