Live › vulnerability › CVE-2026-8451
Go to dashboardNetScaler ADC and NetScaler Gateway appliances configured as a SAML Identity Provider mishandle malformed requests and overread adjacent memory. A remote, unauthenticated attacker can leak chunks of sensitive data from the appliance's memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 18:43 UTC, 0h before NVD. All times on this page are UTC.
Teams running Citrix NetScaler ADC or NetScaler Gateway appliances configured as a SAML Identity Provider are exposed, because the flaw is triggered by malformed SAML requests. The sources do not say that other configurations are safe, and the affected version ranges include 14.1-66.68 with an unknown fix. Teams not running these appliances, or not using them as a SAML IdP, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| citrix netscaler application delivery controller | vendor | < 13.1-37.272 | 13.1-37.272 |
| citrix netscaler application delivery controller | vendor | >= 13.1, < 13.1-63.18 | 13.1-63.18 |
| citrix netscaler application delivery controller | vendor | >= 14.1, < 14.1-72.61 | 14.1-72.61 |
| citrix netscaler application delivery controller | vendor | = 14.1-66.68 | – |
| citrix netscaler gateway | vendor | >= 13.1, < 13.1-63.18 | 13.1-63.18 |
| citrix netscaler gateway | vendor | >= 14.1, < 14.1-72.61 | 14.1-72.61 |
13.1-37.272, 13.1-63.18, 14.1-72.61).13.1-63.18 on the 13.1 train or 14.1-72.61 on the 14.1 train, per Citrix bulletin CTX696604.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WAF Release - 2026-07-14 · Changelog
New updates and improvements at Cloudflare.
July 14, 2026
This release introduces new rules targeting critical infrastructure vulnerabilities. These include an unauthenticated memory disclosure flaw in Citrix NetScaler ADC and Gateway (CVE-2026-8451) and a high-severity pre-authentication remote code execution (RCE) vulnerability in Progress Kemp LoadMaster (CVE-2026-8037).
Key Findings
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...76973ac4 | N/A | Citrix Netscaler ADC - Insufficient Input Validation - CVE:CVE-2026-8451 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...10233f36 | N/A | Progress Kemp LoadMaster - Remote Code Execution - CVE:CVE-2026-8037 | Log | Block | This is a new detection. |
This page as .md · .json · in your agent: get_signal("CVE-2026-8451")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.