CVE-2026-8452: Citrix NetScaler ADC/Gateway Memory Buffer DoS

Executive summary

CVE-2026-8452 is a memory buffer overflow (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway that Citrix originally disclosed as a denial-of-service issue in security bulletin CTX696604, published June 30, 2026, alongside five other CVEs (CVE-2026-8451, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, and CVE-2026-13474). Citrix’s own scoring puts it at CVSS 8.8 (CVSS v4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L), network-exploitable, low complexity, no authentication or user interaction required. Some third-party trackers list it as high as 9.8 under CVSS v3.1 scoring.

CISA added CVE-2026-8452 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-26 with a due date of 2026-08-29, a three-day remediation window well short of the standard two-week KEV timeline. That compression is not arbitrary: on August 14, 2026, researchers at watchTowr Labs published a detailed technical write-up and working proof-of-concept demonstrating that the bug is not merely a crash-and-reboot DoS as Citrix’s advisory implied, but a write-what-where primitive that can be weaponized into unauthenticated, pre-auth remote code execution as root. Three days later, the Canadian Centre for Cyber Security reported indications of active exploitation in the wild. CISA’s KEV entry followed shortly after, reflecting that trajectory of public PoC plus confirmed exploitation against internet-facing appliances that sit directly in front of VPN and authentication traffic.

This is a pattern NetScaler defenders have seen before. CitrixBleed (CVE-2023-4966) and the 2023 auth-bypass chain both went from advisory to mass exploitation within days once technical detail became public, and both were used for ransomware access and nation-state intrusions. Security teams should treat CVE-2026-8452 with the same urgency regardless of whether their current appliance configuration matches the documented exploitation prerequisites.

Affected versions

Per Citrix’s CTX696604 bulletin, CVE-2026-8452 affects:

• NetScaler ADC and NetScaler Gateway 14.1 before build 14.1-72.61
• NetScaler ADC and NetScaler Gateway 13.1 before build 13.1-63.18
• NetScaler ADC 14.1-FIPS before build 14.1-72.61 FIPS
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP before build 13.1-37.272

Exploitation requires the appliance to be configured in a role that processes SAML authentication traffic: as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server acting as a SAML Service Provider or Identity Provider. Appliances used purely for load balancing or content switching, with no Gateway/AAA/SAML role configured, are not exposed to this specific code path.

Fixed builds:

• NetScaler ADC and NetScaler Gateway 14.1-72.61 and later
• NetScaler ADC and NetScaler Gateway 13.1-63.18 and later
• NetScaler ADC 14.1-FIPS 14.1-72.61 FIPS and later
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.272 and later

Citrix’s end-of-life NetScaler ADC and Gateway version 12.1 and 13.0 are not covered by this bulletin because they are past their support lifecycle; organizations still running them are exposed with no vendor patch path and should prioritize migration.

Vulnerability details

The root cause is in how NetScaler’s SAML implementation performs signature canonicalization. When NetScaler processes a signed SAML message, either as a Service Provider validating an assertion or an Identity Provider validating a request, it parses the ds:SignedInfo element of the XML signature block. Within that element, the InclusiveNamespaces construct has a PrefixList attribute meant to hold a short, space-separated list of XML namespace prefixes, but it accepts arbitrary attacker-controlled string content with no meaningful length enforcement in vulnerable builds.

According to watchTowr’s analysis, vulnerable code copies this attacker-controlled PrefixList value into a fixed-size global buffer during canonicalization without verifying that the data actually fits. By supplying an oversized PrefixList (watchTowr’s PoC uses several thousand space-separated unique tokens), an attacker triggers a linear heap overflow that spills past the buffer boundary and corrupts adjacent heap chunk metadata.

That corruption is where CWE-119 stops being just a crash bug. WatchTowr’s research shows the overflow can be shaped into a write-what-where primitive: by controlling both the source and destination of a subsequent memcpy-style operation, an attacker can overwrite a function pointer (tx_pkt_complete_fptr in the researchers’ writeup) to redirect execution into attacker-supplied shellcode staged on a writable, executable heap region. From there, the PoC uses syscalls to drop a PHP webshell and set SUID bits on system binaries, achieving full root-level code execution with a single unauthenticated HTTP(S) request and no credentials.

Citrix’s advisory language (“unpredictable or erroneous behavior and Denial of Service”) describes the safe, reliable outcome of an unrefined trigger. The exploitation research shows the same bug, refined with heap grooming, produces RCE. Treat this as a critical remote code execution vulnerability, not a mere availability issue, when prioritizing patching.

Exploitation in the wild

Citrix NetScaler has one of the most consistent exploitation track records of any enterprise network appliance. CitrixBleed (CVE-2023-4966) was exploited by ransomware affiliates and nation-state actors within roughly two weeks of disclosure and hit healthcare and financial-sector victims broadly. CVE-2022-27510 and CVE-2023-3519 were both added to KEV following confirmed exploitation waves, and Bishop Fox’s own prior NetScaler RCE research (referenced in their CVE-2026-8452 writeup as “three years since the last publicly documented NetScaler RCE”) underscores that public PoC detail tends to move NetScaler bugs from theory to mass exploitation quickly.

CVE-2026-8452 follows the same arc, documented publicly as follows:

• June 30, 2026: Citrix publishes CTX696604, disclosing the vulnerability as a DoS-class memory overflow with a patch already available.
• August 14, 2026: watchTowr Labs publishes a full technical breakdown and working RCE proof-of-concept exploit, moving the bug from “DoS per vendor advisory” to “unauthenticated root RCE, publicly documented.”
• August 17, 2026: The Canadian Centre for Cyber Security reports indications of active exploitation in the wild following the watchTowr publication.
• August 26, 2026: CISA adds CVE-2026-8452 to the KEV catalog with a compressed three-day remediation deadline of August 29, 2026.

Bishop Fox’s follow-up detection research, published to help defenders verify patch status without crashing production appliances, separately notes that a sibling bulletin CVE, CVE-2026-8451, is “already under active exploitation,” reinforcing that this whole CTX696604 batch of NetScaler SAML/AAA bugs is being actively probed and weaponized, not just CVE-2026-8452 in isolation. No specific ransomware group or named threat actor has been publicly attributed to CVE-2026-8452 exploitation as of this writing, and no confirmed ransomware deployment has been tied to it; CISA’s KEV entry marks known exploitation, not confirmed ransomware use. Given the appliance’s role as an internet-facing authentication and VPN gateway, and NetScaler’s history as a preferred initial-access vector for ransomware crews and state-aligned intrusion sets alike, organizations should assume opportunistic scanning is already underway rather than wait for attribution.

Patch and remediation

There is no configuration-only workaround for CVE-2026-8452. Citrix’s guidance, and NetScaler Console’s own remediation workflow, is a direct upgrade to a fixed build:

• Upgrade NetScaler ADC/Gateway 14.1 deployments to 14.1-72.61 or later
• Upgrade NetScaler ADC/Gateway 13.1 deployments to 13.1-63.18 or later
• Upgrade FIPS/NDcPP builds to the corresponding fixed FIPS/NDcPP release noted above

Given confirmed exploitation and a public RCE PoC, patching should be treated as an emergency change, not a scheduled maintenance-window item, consistent with CISA’s compressed three-day deadline. If an immediate upgrade genuinely cannot happen before the KEV deadline, reduce SAML attack surface as an interim step: where feasible, disable SAML-based authentication flows on the affected Gateway/AAA virtual servers, restrict inbound access to Gateway/AAA endpoints to trusted source IP ranges, and monitor closely per the detection guidance below. These are stop-gap measures only; Citrix has not published an official configuration mitigation for this CVE, and they should not substitute for patching.

After patching, verify the fix took effect rather than assuming the upgrade alone resolved exposure. Appliances compromised prior to patching remain compromised after an in-place upgrade, since the update does not remove implants already dropped on the filesystem.

Detection

Because the vulnerable code path sits in SAML signature processing on Gateway/AAA virtual servers, detection should focus on both exploitation attempts and evidence of prior compromise:

• ns.log crash signatures: Look for NSPPE (NetScaler Packet Processing Engine) crashes logged as “got signal 10 or 11,” which indicate a segmentation fault consistent with a failed or partially successful overflow attempt. A crash alone is not proof of successful exploitation; failed attempts can produce the same surface symptom as a deliberate DoS trigger.
• Core dump review: Fresh NSPPE core dumps containing repeated PrefixList-style text patterns in memory are a strong indicator of exploitation attempts against this specific code path.
• Filesystem artifacts: Check for unexpected files under /var/vpn/theme/, a location Bishop Fox’s research flagged as a common webshell drop point following successful exploitation. Also review for newly SUID-set binaries that shouldn’t have that bit.
• SAML/authentication traffic anomalies: Inspect Gateway and AAA access logs for SAML requests or assertions with abnormally large InclusiveNamespaces / PrefixList attribute values. Legitimate use is a handful of short namespace prefixes; malicious payloads use large numbers of long, space-separated tokens.
• Patch verification without production risk: If you need to confirm patch status against a fleet of appliances without risking a crash, use a length-oracle probe approach: patched builds reject oversized PrefixList payloads (roughly 513+ bytes in Bishop Fox’s testing) with an explicit “Malformed Assertion sent to Netscaler” error, while unpatched builds return a generic internal server error at that same threshold. Bishop Fox has published an automated, non-destructive tool implementing this check.
• General appliance integrity: As with any suspected NetScaler compromise, review for unauthorized administrative accounts, modified configuration, unexpected outbound connections from the appliance, and session tokens issued outside of normal authentication flows.

Given the appliance’s role fronting VPN and SSO traffic, any confirmed or suspected compromise should trigger session token invalidation and credential rotation for affected user populations, not just appliance-level remediation.

Sources

• Citrix Security Bulletin CTX696604
• watchTowr Labs, “You’re Back In The Room” (CVE-2026-8452 RCE research)
• Bishop Fox, “No Crash Required: Verifying the Citrix NetScaler SAML Patch”
• Field Effect, “Citrix NetScaler flaw exploited following PoC release”
• NHS England Digital, PoC exploit alert
• NVD, CVE-2026-8452