Citrix NetScaler ADC and Gateway Vulnerability Enables Cross-Site Scripting Attacks

**Citrix NetScaler ADC/Gateway XSS (CVE-2025-12101)**: Cloud Software Group disclosed a CWE-79 cross-site scripting vulnerability in NetScaler ADC and Gateway affecting multiple 12.x–14.x releases (including FIPS/NDcPP variants) that requires Gateway or AAA virtual-server configurations; the issue is assigned CVSSv4 5.9 (moderate), no active exploitation has been reported, and the vendor provides free patches and upgrade guidance while urging affected customers—especially those on EOL versions—to update or migrate.