CVE-2025-4365

NetScaler Console and NetScaler SDX (SVM) - Arbitrary file read

Exploitation likely. EPSS gives it a 11% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.17.5High EPSS percentile96th11% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2025-06-17Updated 2025-08-06Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Ask IT to identify whether you run NetScaler Console or NetScaler SDX (SVM) and record its version.
Upgrade Console and SDX (SVM) to fixed version 47.46 or 58.32, as applicable to your release branch.
If you use netscaler sdx, upgrade to 13.1-58.32 and confirm the update completed successfully.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Arbitrary file read in NetScaler Console and NetScaler SDX (SVM)

In plain language

Written by AI from the record

NetScaler Console and NetScaler SDX (SVM) have a flaw that can expose files to an outsider, so small businesses using them should schedule an update soon.

Unauthenticated network-accessible arbitrary file read in NetScaler Console and NetScaler SDX (SVM), tracked as CWE-1284, can disclose sensitive server files.

If you're affected

Sensitive file exposure
Credential theft risk
Configuration disclosure
Further system compromise

What is it

This flaw can let an outsider read files from the affected system without permission. It is like someone being able to look through a locked office filing cabinet: they may not change the papers, but they can see information that helps them cause further harm.

Who is affected

This matters to you if you run NetScaler Console and NetScaler SDX (SVM) to manage network appliances. An attacker does not need an account or someone at your business to click anything to attempt it. The findings do not state whether internet exposure is required.

How urgent is it

Attackers can attempt this remotely without an account, and the predicted likelihood of exploitation is rising. There is no record of active exploitation or public exploit code, so this is an amber priority: plan and complete the update soon rather than treating it as an emergency outage.

What to do — in detail

Confirm exposure by inventorying NetScaler Console and NetScaler SDX (SVM) deployments, their installed versions, and which management interfaces can be reached from untrusted networks. The vendor lists 47.46 and 58.32 as fixed releases for Console and SDX (SVM); for netscaler sdx, the listed fixed release is 13.1-58.32. Follow the vendor advisory for the supported upgrade path; the findings do not provide compatibility or breaking-change information, so review release notes before upgrading.

If patching must wait, no vendor workaround is included in the findings; restrict access to management interfaces to trusted administrator networks and remove unnecessary external access. No CISA KEV due date applies because this CVE is not listed in KEV. Review access and web-request logs around the management service for unusual file-request patterns, and investigate any unexpected disclosure of configuration or credential files.

Technical context

CVSS v3.1 is 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The issue is an arbitrary file-read vulnerability mapped to CWE-1284: it is remotely reachable, requires low complexity, no privileges, and no user interaction, with high confidentiality impact but no stated integrity or availability impact. CISA KEV does not list this CVE, and no public exploit code is on record. EPSS predicts a 10.8% likelihood and is rising (96th percentile); this is predictive only, not evidence of exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

11% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 458 days, from the signal feeds we watch.

2026-09-18EPSS band change0 → moderateepss band change
2026-06-25OpenVAS check added
2025-08-06Patch availablerecord updated
2025-06-17Publishedweakness classified

Affected products

NetScalercommercial · USaka citrix, xenserver, netscaler gateway firmware, application delivery controller firmware
- ConsoleOn-premNetworking Infrastructure / load-balancer-proxy
- SDX (SVM)On-premNetworking Infrastructure / load-balancer-proxy
- netscaler consoleNetwork DeviceOn-premNetworking Infrastructure / load-balancer-proxy
- netscaler sdxMixedCloud & SaaS / virtualization

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact

Weaknesses

CWE-1284No name in the record

Sources

References in the record

support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694729

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Console, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account