NETSCOUT vulnerabilities (CVEs)

40 CVEs matched to NETSCOUT by name in NVD, none on CISA's Known Exploited list.

Back to the NETSCOUT profile · Alternatives to NETSCOUT · CVE RSS feed

Exploitation riskProbably exploited

40 of 40 CVEs assessed

confirmed exploited

EPSS ≥ 10%

95%

highest single CVE

Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.

CVE-2008-6701 ↗EPSS 1.4%LEV ≥95%Probably exploited
NetScout (formerly Network General) Visualizer V2100 and InfiniStream i1730 do not restrict access to ResourceManager/en_US/domains/add_domain.jsp, which allows…
CVE-2020-28251 ↗EPSS 1.2%LEV ≥57%Probably exploited
NETSCOUT AirMagnet Enterprise 11.1.4 build 37257 and earlier has a sensor escalated privileges vulnerability that can be exploited to provide someone with admin…
CVE-2021-45983 ↗EPSS 1.4%LEV ≥53%Probably exploited
NetScout nGeniusONE 6.3.2 allows Java RMI Code Execution.
CVE-2021-35201 ↗EPSS 1.0%LEV ≥45%Elevated risk
NEI in NETSCOUT nGeniusONE 6.3.0 build 1196 allows XML External Entity (XXE) attacks.
CVE-2021-45981 ↗EPSS 1.1%LEV ≥45%Elevated risk
NetScout nGeniusONE 6.3.2 allows an XML External Entity (XXE) attack.

Recent changes

last 90 days

CVE-2022-44024 is now estimated at a 14% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2021-35201 is now estimated at a 44% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2008-6701 is now estimated at a 94% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2021-45982 is now estimated at a 39% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2022-44025 is now estimated at a 14% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗

CVE severity over time

CVEs by year and severity

Count of matched CVEs by the year NVD published them.
Year	Critical	High	Medium	Low	Total
2025	2	4	2	0	8
2024	1	0	0	0	1
2023	3	1	12	2	18
2022	2	1	0	0	3
2021	0	0	8	0	8
2020	0	1	0	0	1
2009	0	1	0	0	1

Highest EPSS scores

EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.

CVE	EPSS	Percentile
CVE-2023-40301	1.5%	74%
CVE-2021-45983	1.4%	73%
CVE-2008-6701	1.4%	71%
CVE-2020-28251	1.2%	67%
CVE-2021-45981	1.1%	66%
CVE-2023-26999	1.1%	64%
CVE-2021-45982	1.0%	62%
CVE-2021-35201	1.0%	61%
CVE-2023-40302	0.8%	57%
CVE-2022-44715	0.7%	54%

Known CVEs (40)

RSS ⇢

CVE-2025-32986 ↗HIGH 7.52025
NETSCOUT nGeniusONE before 6.4.0 b2350 has a Sensitive File Accessible Without Proper Authentication to an endpoint.
CVE-2025-32985 ↗CRITICAL 9.82025
NETSCOUT nGeniusONE before 6.4.0 b2350 has Hardcoded Credentials that can be obtained from JAR files.
CVE-2025-32984 ↗MEDIUM 6.1

How this is counted

CVEs come from the US National Vulnerability Database (NVD) and are matched to NETSCOUT by vendor name. A name match can include CVEs that concern a similarly named product, and can miss ones filed under another name. The count reflects how widely a vendor's software is deployed and examined as much as anything else, so it is not a measure of how secure the vendor is and should not be used to rank vendors. Latest CVE added here: 2026-07-17.
Known-exploited status comes from the CISA Known Exploited Vulnerabilities (KEV) catalog. Last checked: 2026-10-20.
Exploit probability (EPSS) comes from FIRST. Latest score date: 2026-10-20.