What’s Vulnerable › Vulnerabilities
CVE-2025-12101: Cross-Site Scripting (XSS)
- Severity: medium (CVSS 5.9 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 26.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-11-11 · updated 2026-10-18
- Weakness: CWE-79
Description
Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server
Affected products
- NetScaler ADC: from 14.1 before 56.73; from 13.1 before 60.32; from 13.1-FIPS and NDcPP before 37.250; from 12.1-FIPS and NDcPP before 55.333 — fixed in 37.250, 55.333, 56.73, 60.32
- NetScaler Gateway: from 14.1 before 56.73; from 13.1 before 60.32; from 13.1-FIPS and NDcPP before 37.250; from 12.1-FIPS and NDcPP before 55.333 — fixed in 37.250, 55.333, 56.73, 60.32
How to fix
Upgrade to a fixed version: NetScaler ADC 37.250, 55.333, 56.73, 60.32; NetScaler Gateway 37.250, 55.333, 56.73, 60.32. Check the vendor advisory for mitigations.
In the news
References
Get alerted when CVE-2025-12101 or the next vulnerability affects your stack