CVE-2025-8424

ENISA EUVD: EUVD-2025-25868 ↗

✓ Confirmed 0-Day

Triaged: March 5, 2026 3 articles Published: 2025-08-26

VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗

EPSS Score

Source: FIRST.org · 2026-05-23

0.38%

probability

This CVE has a 0.38% probability of being exploited in the next 30 days.

0% Top 59.6th percentile of all CVEs 100%

CVSS v4.0 NEW

Source: VulnerabilityLookup (CIRCL)

8.7

HIGH

Attack Vector

Adjacent

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable System Confidentiality Impact

High

Vulnerable System Integrity Impact

High

Vulnerable System Availability Impact

High

Subsequent System Confidentiality Impact

Low

Subsequent System Integrity Impact

Low

Subsequent System Availability Impact

Low

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

Description

VulnerabilityLookup (CNA)

Improper access control on the NetScaler Management Interface in NetScaler ADC and NetScaler Gateway when an attacker can get access to the appliance NSIP, Cluster Management IP or local GSLB Site IP or SNIP with Management Access

Affected Products

NetScaler

ADC

14.1 13.1 13.1 FIPS and NDcPP 12.1 FIPS and NDcPP

NetScaler

Gateway

14.1 13.1 13.1 FIPS and NDcPP 12.1 FIPS and NDcPP

Attack Intelligence

CWE-1284 · Improper Validation of Integer Value CWE-20 · Improper Input Validation CWE-707 · Improper Neutralization

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938

Signal Intelligence

Confidenceⓘ

85%

EPSS 0.38%

CVSS v4.0 8.7

Mentions 3

Last Seen Aug 26, 2025

CNA Information

CNA Assigner

Citrix

CNA Title

Improper access control on the NetScaler Management Interface

Analyst Note

CVE-2025-8424 is a 2025 vulnerability with explicit zero-day exploitation reported by BleepingComputer (high signal score of 8). The article title directly states 'exploited in zero-day attacks,' and the recent publication date (2025-08-26) combined with immediate exploitation reporting indicates active attacks preceded or coincided with patch availability. No contradictory timing evidence suggests otherwise.