CVE-2025-4365

This flaw can let an outsider read files from the affected system without permission. It is like someone being able to look through a locked office filing cabinet: they may not change the papers, but they can see information that helps them cause further harm.

This matters to you if you run NetScaler Console and NetScaler SDX (SVM) to manage network appliances. An attacker does not need an account or someone at your business to click anything to attempt it. The findings do not state whether internet exposure is required.

Attackers can attempt this remotely without an account, and the predicted likelihood of exploitation is rising. There is no record of active exploitation or public exploit code, so this is an amber priority: plan and complete the update soon rather than treating it as an emergency outage.

Confirm exposure by inventorying NetScaler Console and NetScaler SDX (SVM) deployments, their installed versions, and which management interfaces can be reached from untrusted networks. The vendor lists 47.46 and 58.32 as fixed releases for Console and SDX (SVM); for netscaler sdx, the listed fixed release is 13.1-58.32. Follow the vendor advisory for the supported upgrade path; the findings do not provide compatibility or breaking-change information, so review release notes before upgrading.

If patching must wait, no vendor workaround is included in the findings; restrict access to management interfaces to trusted administrator networks and remove unnecessary external access. No CISA KEV due date applies because this CVE is not listed in KEV. Review access and web-request logs around the management service for unusual file-request patterns, and investigate any unexpected disclosure of configuration or credential files.

CVSS v3.1 is 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The issue is an arbitrary file-read vulnerability mapped to CWE-1284: it is remotely reachable, requires low complexity, no privileges, and no user interaction, with high confidentiality impact but no stated integrity or availability impact. CISA KEV does not list this CVE, and no public exploit code is on record. EPSS predicts a 10.8% likelihood and is rising (96th percentile); this is predictive only, not evidence of exploitation.