High severity · published Aug 26, 2025
CVE-2025-8424
Improper access control on the NetScaler Management Interface
8.7
CVSS
3.7%
EPSS
No
On KEV
Description
Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway when an attacker can get access to the appliance NSIP, Cluster Management IP or local GSLB Site IP or SNIP with Management Access
Exploitation
Is it being used?
Exploit prediction (EPSS)3.7% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AD
ADC · NetScaler
14.1 before 47.48; 13.1 before 59.22; 13.1 FIPS and NDcPP before 37.241; 12.1 FIPS and NDcPP before 55.330 · source: vendor
GA
Gateway · NetScaler
14.1 before 47.48; 13.1 before 59.22; 13.1 FIPS and NDcPP before 37.241; 12.1 FIPS and NDcPP before 55.330 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8424
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8424
support.citrix.com
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938
More from ADC
9.8
CVE-2026-19490
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
9.8
CVE-2026-8452
Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service
9.8
CVE-2026-3055
Insufficient input validation leading to memory overread
9.8
CVE-2025-7775
Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service
9.8
CVE-2025-6543
Memory overflow vulnerability leading to unintended control flow and Denial of Service