What’s Vulnerable › Vulnerabilities
CVE-2025-8424: Improper access control on the NetScaler Management Interface
- Severity: high (CVSS 8.7 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-08-26 · updated 2026-06-17
- Weakness: CWE-1284
Description
Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway when an attacker can get access to the appliance NSIP, Cluster Management IP or local GSLB Site IP or SNIP with Management Access
Affected products
- NetScaler ADC: from 14.1 before 47.48; from 13.1 before 59.22; from 13.1 FIPS and NDcPP before 37.241; from 12.1 FIPS and NDcPP before 55.330 — fixed in 37.241, 47.48, 55.330, 59.22
- NetScaler Gateway: from 14.1 before 47.48; from 13.1 before 59.22; from 13.1 FIPS and NDcPP before 37.241; from 12.1 FIPS and NDcPP before 55.330 — fixed in 37.241, 47.48, 55.330, 59.22
How to fix
Upgrade to a fixed version: NetScaler ADC 37.241, 47.48, 55.330, 59.22; NetScaler Gateway 37.241, 47.48, 55.330, 59.22. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2025-8424 or the next vulnerability affects your stack