---
title: "CVE-2025-8424: Improper access control on the NetScaler Management Interface"
url: https://erroneo.us/security/cve/CVE-2025-8424/
description: "CVE-2025-8424 (NetScaler ADC): Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway when an attacker can get…"
type: vulnerability-record
section: "Security Digest"
date_published: 2025-08-26
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2025-8424"
kev: false
cvss: 8.7
epss: 0.03341
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2025-8424: Improper access control on the NetScaler Management Interface

**Signal:** Normal patch cycle. No exploitation signal; fix it in your next routine update if you are affected. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 3.3% , percentile 89: FIRST’s model estimates a 3.3% chance of exploitation activity in the next 30 days, higher than 89% of all scored CVEs (elevated). EPSS is a probability, not a verdict.
- Editorial verdict: Check exposure. NetScaler CVE-2025-7775: Exploited Pre-Auth Memory Overflow — Fixed since August 2025, but it was exploited before the patch to plant web shells; any appliance that ran an old build as a Gateway or AAA server back then needs a compromise check, and every NetScaler needs a far newer build today.

## What it is

Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway when an attacker can get access to the appliance NSIP, Cluster Management IP or local GSLB Site IP or SNIP with Management Access

## Affected products (CVE record)

- NetScaler ADC: 14.1 < 47.48, 13.1 < 59.22, 13.1 FIPS and NDcPP < 37.241, 12.1 FIPS and NDcPP < 55.330
- NetScaler Gateway: 14.1 < 47.48, 13.1 < 59.22, 13.1 FIPS and NDcPP < 37.241, 12.1 FIPS and NDcPP < 55.330

## Severity

- Citrix CVSS 4.0: 8.7 `CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-23): 3.34% probability of exploitation activity in the next 30 days; percentile 89.

## Sources

- [CVE.org record CVE-2025-8424](https://www.cve.org/CVERecord?id=CVE-2025-8424)
- [NVD entry CVE-2025-8424](https://nvd.nist.gov/vuln/detail/CVE-2025-8424)
- [support.citrix.com](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938)

---
Source page: https://erroneo.us/security/cve/CVE-2025-8424/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt