Cyber Security Alert: CVE affecting Citrix Netscaler products

  • Posted June 24, 2025

The NCSC would like to draw your attention to two critical vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway Products.

CVE-2025-5777 (CVSS 9.3): An insufficient input validation leading to memory overread vulnerability. This vulnerability affects NetScaler products configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

CVE-2025-5349 (CVSS 8.7): An improper access control vulnerability in the NetScaler Management Interface.

The following supported versions of NetScaler ADC and NetScaler Gateway are affected by the vulnerabilities:

  • NetScaler ADC and NetScaler Gateway 14.1 BEFORE 14.1-43.56
  • NetScaler ADC and NetScaler Gateway 13.1 BEFORE 13.1-58.32
  • NetScaler ADC 13.1-FIPS and NDcPP BEFORE 13.1-37.235-FIPS and NDcPP
  • NetScaler ADC 12.1-FIPS BEFORE 12.1-55.328-FIPS 

Note: NetScaler ADC and NetScaler Gateway versions 12.1 and 13.0 are end-of-life (EOL) but are also vulnerable.

The NCSC encourages organisations in New Zealand that use the affected products to review the vendor advisory(external link) and apply the remediations as soon as possible.

For more NCSC NZ updates, follow us on LinkedIn(external link). 

Latest headlines

Back to News