CVE-2025-12101CWE-79cross-site-scripting

CVE-2025-12101

published November 11, 2025

CVSS

5.9

EPSS

26%

Percentile

98.0

In the wild

Unconfirmed

What it is

Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server

The record

Technical detail

CVSS: 5.9 · NONE
CVSS v4.0: Not supplied
EPSS: 0.26250 · 98.0th percentile
Weakness: CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published: 2025-11-11T19:15Z

References (1)

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX695486 · [email protected]

EPSS history

Timeline

11 NOV 13:44Z
Cross-Site Scripting (XSS)
cvelistv5