Citrix NetScaler ADC and Gateway Flaw Allows Cross-Site Scripting (XSS) Attacks

Cloud Software Group has disclosed a cross-site scripting (XSS) vulnerability affecting NetScaler ADC and NetScaler Gateway platforms, tracked as CVE-2025-12101. According to Cloud Software Group, the flaw enables attackers to inject malicious scripts into web pages served by affected NetScaler instances and could allow threat actors to execute arbitrary code in users’ browsers, with potential for session hijacking, credential theft, or malware distribution.

The vulnerability affects multiple NetScaler versions, including 14.1 before 14.1-56.73 and 13.1 before 13.1-60.32, with end-of-life versions such as 12.1 and 13.0 remaining vulnerable, and FIPS-compliant builds also affected. The attack requires specific configurations and user interaction, limiting its immediate threat, and it manifests only when NetScaler is configured as a Gateway with certain virtual server types or when AAA authentication servers are used.

Patches are advised; administrators should upgrade to NetScaler ADC and Gateway version 14.1-56.73 or later, or 13.1-60.32 and later, and migrate end-of-life deployments to supported platforms. The discovery credits go to Sina Kheirkhah of watchTowr and Dylan Pindur of Assetnote, who collaborated with Cloud Software Group prior to public disclosure.