PT-2025-25743 · Citrix · Citrix Netscaler

Published 2025-06-17 · Updated 2025-07-21 · CVE-2025-24286

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The product name cannot be determined.

Description A vulnerability exists that allows an authenticated user with the Backup Operator role to modify backup jobs. This modification could potentially execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-24286

ZDI-25-625

Affected Products

Citrix Netscaler

References · 15

• https://osv.dev/vulnerability/CVE-2025-24286 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-24286 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-625 · Security Note
• https://veeam.com/kb4743 · Vendor Advisory
• https://t.me/cvenotify/126406 · Telegram Post
• https://twitter.com/samilaiho/status/1935574554698453255 · Twitter Post
• https://t.me/cvenotify/129218 · Telegram Post
• https://t.me/latest_high_impact_cve/2714 · Telegram Post
• https://t.me/cvetracker/26541 · Telegram Post
• https://twitter.com/BlackpointUS/status/1935030881535803708 · Twitter Post
• https://t.me/purp_sec/776 · Telegram Post
• https://twitter.com/BlackpointUS/status/1935030884257976408 · Twitter Post
• https://twitter.com/NoLabNoPartY/status/1934979202454794750 · Twitter Post
• https://twitter.com/CVEnew/status/1935723274534842802 · Twitter Post
• https://reddit.com/r/sysadmin/comments/1ldqw6p/d%C3%A9j%C3%A0_vu_critical_cvss_99_veeam_backup_replication · Reddit Post