CVE-2025-8424

Improper access control on the NetScaler Management Interface

State: Published
Severity: 8.7 High
Published: Aug 26, 2025
Updated: Feb 26, 2026
Reserved: Jul 31, 2025

Description

Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway when an attacker can get access to the appliance NSIP, Cluster Management IP or local GSLB Site IP or SNIP with Management Access

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L	Citrix

Weaknesses

CWE-1284 Improper Validation of Specified Quantity in Input

Affected Products

Product	Versions
ADCNetScaler	14.1 to before 47.48Affected 13.1 to before 59.22Affected 13.1 FIPS and NDcPP to before 37.241Affected 12.1 FIPS and NDcPP to before 55.330Affected
GatewayNetScaler	14.1 to before 47.48Affected 13.1 to before 59.22Affected 13.1 FIPS and NDcPP to before 37.241Affected 12.1 FIPS and NDcPP to before 55.330Affected

References

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.