What’s Vulnerable › Vulnerabilities
CVE-2025-5349: NetScaler ADC and NetScaler Gateway - Improper access control on the NetScaler Management Interface
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 6.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-06-17 · updated 2026-06-17
- Weakness: CWE-1284
Description
Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway
Affected products
- Citrix NetScaler ADC: from 13.1 before 13.1-58.32; from 14.1 before 14.1-43.56 — fixed in 13.1-58.32, 14.1-43.56
- Citrix Netscaler Application Delivery Controller Fips: from 12.1 before 12.1-55.328; from 13.1 before 13.1-37.235 — fixed in 12.1-55.328, 13.1-37.235
- Citrix Netscaler Application Delivery Controller Ndcpp: from 13.1 before 13.1-37.235 — fixed in 13.1-37.235
- Citrix NetScaler Gateway: from 13.1 before 13.1-58.32; from 14.1 before 14.1-43.56 — fixed in 13.1-58.32, 14.1-43.56
- NetScaler ADC: from 14.1 before 43.56; from 13.1 before 58.32 — fixed in 43.56, 58.32
How to fix
Upgrade to a fixed version: Citrix NetScaler ADC 13.1-58.32, 14.1-43.56; Citrix Netscaler Application Delivery Controller Fips 12.1-55.328, 13.1-37.235; Citrix Netscaler Application Delivery Controller Ndcpp 13.1-37.235; Citrix NetScaler Gateway 13.1-58.32, 14.1-43.56; NetScaler ADC 43.56, 58.32. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-5349 or the next vulnerability affects your stack