CVE-2015-7997: Multiple cross-site scripting (XSS) vulnerabilities in the Nitro API in Citrix NetScaler Application Delive...

Security readout for executives and security teams

This CVE describes multiple XSS flaws in the Citrix NetScaler Nitro API. A remote attacker could inject web script or HTML through unspecified vectors. The sources name affected pre-fix builds but provide no CVSS score, CWE mapping, or evidence of active exploitation. Exposure is most likely where affected NetScaler ADC, Gateway, or SDX SVM builds remain deployed, especially if the Nitro API or management interfaces are reachable by untrusted users or networks. Treat this as a targeted hygiene item for legacy Citrix infrastructure. It is not KEV-listed in the provided bundle, but exposed management/API surfaces on old NetScaler builds should be upgraded or tightly restricted. Mitigation focus: Identify all NetScaler ADC, Gateway, and SDX SVM deployments.; Upgrade affected 10.1, 10.5, and 10.5.e builds to the cited fixed builds or later.; Check Citrix CTX202482 for vendor-supported remediation guidance..

Prepared

Jun 13, 2026, 21:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.