VulnerabilityDeferred

CVE-2025-12101

Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

MEDIUM 5.9EPSS 25.4%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 25.4%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.

Description

Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

CVSS 4.0: 5.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 25.40% probability · 98th percentile
CISA KEV: Not listed
Weakness: CWE-79
Source: secure@citrix.com

References

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX695486

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.