CVE-2024-12284: Authenticated privilege escalation

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-19 · updated 2026-06-17
Weakness: CWE-269

Description

Authenticated privilege escalation in NetScaler Console and NetScaler Agent allows.

Affected products

Citrix Netscaler Agent: from 13.1-4.43 before 13.1-56.18; from 14.1-4.42 before 14.1-38.53; 13.0-58.30 (and their updates) — fixed in 13.1-56.18, 14.1-38.53
NetScaler Console: 13.1-build12.50, 13.1-build17.42, 13.1-build21.53, 13.1-build24.38, 13.1-build27.62, 13.1-build30.52 (+21)
NetScaler Agent: from 14.1 before 38.53; from 13.1 before 56.18 — fixed in 38.53, 56.18
NetScaler Console: from 14.1 before 38.53; from 13.1 before 56.18 — fixed in 38.53, 56.18

How to fix

Upgrade to a fixed version: Citrix Netscaler Agent 13.1-56.18, 14.1-38.53; NetScaler Agent 38.53, 56.18; NetScaler Console 38.53, 56.18. Check the vendor advisory for mitigations.

References

https://support.citrix.com/s/article/CTX692579-netscaler-console-and-netscaler-agent-security-bulletin-for-cve202412284?language=en_US

Get alerted when CVE-2024-12284 or the next vulnerability affects your stack