{"id":"CVE-2026-8451","kind":"vulnerability","aliases":["CVE-2026-8451"],"related":[],"title":"Citrix NetScaler: malformed SAML requests leak memory from appliances","description":"WAF Release - 2026-07-14 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nJuly 14, 2026\n\n## WAF Release - 2026-07-14\n\nThis release introduces new rules targeting critical infrastructure vulnerabilities. These include an unauthenticated memory disclosure flaw in Citrix NetScaler ADC and Gateway (CVE-2026-8451) and a high-severity pre-authentication remote code execution (RCE) vulnerability in Progress Kemp LoadMaster (CVE-2026-8037).\n\nKey Findings\n\n- CVE-2026-8451: An insufficient input validation vulnerability affects Citrix NetScaler ADC and NetScaler Gateway appliances configured as a SAML Identity Provider (IdP). Remote, unauthenticated attackers can exploit this flaw by sending malformed requests to trigger a memory overread, allowing them to leak chunks of sensitive data from adjacent appliance memory.\n- CVE-2026-8037: A critical OS command injection vulnerability in Progress Kemp LoadMaster load balancers allows unauthenticated remote attackers to achieve remote code execution (RCE).\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...76973ac4 | N/A | Citrix Netscaler ADC - Insufficient Input Validation - CVE:CVE-2026-8451 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...10233f36 | N/A | Progress Kemp LoadMaster - Remote Code Execution - CVE:CVE-2026-8037 | Log | Block | This is a new detection. |","summary":"NetScaler ADC and NetScaler Gateway appliances configured as a SAML Identity Provider mishandle malformed requests and overread adjacent memory. A remote, unauthenticated attacker can leak chunks of sensitive data from the appliance's memory.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"citrix netscaler application delivery controller","fixed":["13.1-37.272"],"affected":"< 13.1-37.272","ecosystem":"vendor"},{"name":"citrix netscaler application delivery controller","fixed":["13.1-63.18"],"affected":">= 13.1, < 13.1-63.18","ecosystem":"vendor"},{"name":"citrix netscaler application delivery controller","fixed":["14.1-72.61"],"affected":">= 14.1, < 14.1-72.61","ecosystem":"vendor"},{"name":"citrix netscaler application delivery controller","fixed":[],"affected":"= 14.1-66.68","ecosystem":"vendor"},{"name":"citrix netscaler gateway","fixed":["13.1-63.18"],"affected":">= 13.1, < 13.1-63.18","ecosystem":"vendor"},{"name":"citrix netscaler gateway","fixed":["14.1-72.61"],"affected":">= 14.1, < 14.1-72.61","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["appliance","citrix","cloudflare","lab-disclosure","netscaler","saml-idp","self-hosted","vendor"],"not_affected_if":["managed-hosting","not-saml-idp"],"how_to_check":"- Check whether the appliance is configured as a SAML Identity Provider (IdP); the sources do not name the exact setting, so confirm in the NetScaler configuration.\n- Check the running build against the affected versions listed in the Citrix bulletin CTX696604 (`13.1-37.272`, `13.1-63.18`, `14.1-72.61`).\n- Check that the appliance is reachable from the internet.","fix":"- Move NetScaler ADC and NetScaler Gateway to a fixed build: `13.1-63.18` on the 13.1 train or `14.1-72.61` on the 14.1 train, per Citrix bulletin CTX696604.\n- Until patched, rely on the Cloudflare WAF rule for Citrix NetScaler ADC - Insufficient Input Validation - CVE:CVE-2026-8451 if the traffic passes through Cloudflare; this is a mitigation, not a fix.","status":"open","published_at":"2026-06-30T13:19:33+00:00","first_seen_at":"2026-10-24T18:43:45+00:00","triaged_at":"2026-10-25T05:29:32+00:00","updated_at":"2026-10-25T05:29:32+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T05:29:32Z","model":"claude-haiku-5-5","output":{"fix":"- Move NetScaler ADC and NetScaler Gateway to a fixed build: `13.1-63.18` on the 13.1 train or `14.1-72.61` on the 14.1 train, per Citrix bulletin CTX696604.\n- Until patched, rely on the Cloudflare WAF rule for Citrix NetScaler ADC - Insufficient Input Validation - CVE:CVE-2026-8451 if the traffic passes through Cloudflare; this is a mitigation, not a fix.","reach":"internet","title":"Citrix NetScaler: malformed SAML requests leak memory from appliances","impact":"medium","summary":"NetScaler ADC and NetScaler Gateway appliances configured as a SAML Identity Provider mishandle malformed requests and overread adjacent memory. A remote, unauthenticated attacker can leak chunks of sensitive data from the appliance's memory.","category":"vendor","nicknames":[],"who_cares":["netscaler","citrix","saml-idp","self-hosted","appliance"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker reads chunks of sensitive data from appliance memory.","analyst_note":"Confirm the fixed version for the 14.1-66.68 build and the exact SAML IdP configuration that triggers the flaw, using Citrix bulletin CTX696604 and the NVD entry.","how_to_check":"- Check whether the appliance is configured as a SAML Identity Provider (IdP); the sources do not name the exact setting, so confirm in the NetScaler configuration.\n- Check the running build against the affected versions listed in the Citrix bulletin CTX696604 (`13.1-37.272`, `13.1-63.18`, `14.1-72.61`).\n- Check that the appliance is reachable from the internet.","needs_analyst":true,"not_affected_if":["not-saml-idp","managed-hosting"],"who_is_affected":"Teams running Citrix NetScaler ADC or NetScaler Gateway appliances configured as a SAML Identity Provider are exposed, because the flaw is triggered by malformed SAML requests. The sources do not say that other configurations are safe, and the affected version ranges include 14.1-66.68 with an unknown fix. Teams not running these appliances, or not using them as a SAML IdP, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000845,"input_tokens":4243,"output_tokens":842,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-07':93C,109C '-14':94C,110C '-2026':11A,14A,134C,154C,159C,210C,259C,281C '-8037':155C,211C,282C '-8451':12A,15A,135C,160C,260C '10233f36':271C '14':104C '2026':92C,105C,108C '76973ac4':249C 'achiev':229C 'action':242C,244C 'adc':57B,130C,169C,253C 'adjac':73B,206C 'affect':166C 'allow':197C,224C 'applianc':9A,42B,61B,87B,173C,207C 'application':18A,23A,28A,33A 'attack':78B,183C,227C 'authent':143C 'balanc':223C 'block':262C,284C 'changelog':95C,96C 'chunk':81B,201C 'citrix':1A,16A,21A,26A,31A,36A,39A,43B,128C,167C,251C 'cloudflar':44B,102C,246C,268C 'code':145C,231C,277C 'command':215C 'comment':245C 'configur':62B,174C 'controller':20A,25A,30A,35A 'critic':117C,213C 'cve':10A,13A,133C,153C,158C,209C,257C,258C,279C,280C 'data':84B,204C 'delivery':19A,24A,29A,34A 'descript':240C 'detect':267C,289C 'disclosur':47B,125C 'execut':146C,232C,278C 'exploit':185C 'find':157C 'flaw':126C,187C 'gateway':38A,41A,60B,132C,172C 'high':139C 'high-sever':138C 'host':54B 'id':236C,239C 'ident':66B,178C 'idp':51B,180C 'improv':100C 'includ':121C 'infrastructur':118C 'inject':216C 'input':163C,255C 'insuffici':162C,254C 'introduc':113C 'juli':103C 'kemp':151C,220C,274C 'key':156C 'lab':46B 'lab-disclosur':45B 'leak':6A,80B,200C 'legaci':237C 'load':222C 'loadmast':152C,221C,275C 'log':261C,283C 'malform':3A,69B,190C 'manag':247C,269C 'memori':7A,74B,89B,124C,195C,208C 'mishandl':68B 'n/a':250C,272C 'netscal':2A,48B,56B,59B,129C,168C,171C,252C 'netscaler':17A,22A,27A,32A,37A,40A 'new':97C,114C,243C,266C,288C 'os':214C 'overread':72B,196C 'pre':142C 'pre-authent':141C 'previous':241C 'progress':150C,219C,273C 'provid':67B,179C 'rce':147C,233C 'releas':91C,107C,112C 'remot':76B,144C,181C,226C,230C,276C 'request':5A,70B,191C 'rule':115C,235C,238C 'ruleset':234C,248C,270C 'saml':4A,50B,65B,177C 'saml-idp':49B 'self':53B 'self-host':52B 'send':189C 'sensit':83B,203C 'sever':140C 'target':116C 'trigger':193C 'unauthent':77B,123C,182C,225C 'updat':98C 'valid':164C,256C 'vendor':55B 'vulner':119C,148C,165C,217C 'waf':90C,106C","nicknames":[],"mitigations":[],"who_affected":"Teams running Citrix NetScaler ADC or NetScaler Gateway appliances configured as a SAML Identity Provider are exposed, because the flaw is triggered by malformed SAML requests. The sources do not say that other configurations are safe, and the affected version ranges include 14.1-66.68 with an unknown fix. Teams not running these appliances, or not using them as a SAML IdP, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-30T13:19:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":0,"sources":[{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-07-14-waf-release/#CVE-2026-8451","url":"https://developers.cloudflare.com/changelog/post/2026-07-14-waf-release/","severity":null,"published_at":"2026-07-14T18:42:44+00:00","modified_at":null,"first_seen_at":"2026-10-24T18:43:45+00:00","fetched_at":"2026-10-24T18:43:45+00:00","note":"Cloudflare: WAF Release - 2026-07-14 · Changelog"},{"source":"nvd","external_id":"CVE-2026-8451","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8451","severity":null,"published_at":"2026-06-30T13:19:33+00:00","modified_at":"2026-07-01T15:52:58+00:00","first_seen_at":"2026-10-24T18:53:56+00:00","fetched_at":"2026-10-24T18:53:56+00:00","note":null}],"documents":[{"id":1183,"url":"https://support.citrix.com/external/article/CTX696604","title":"Citrix bulletin CTX696604 (CVE-2026-8451, -8452, -8655, -10816, -10817, -13474)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2878,"url":"https://developers.cloudflare.com/changelog/post/2026-07-14-waf-release/","title":"Cloudflare: WAF Release - 2026-07-14 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-07-14 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nJuly 14, 2026\n\n## WAF Release - 2026-07-14\n\nThis release introduces new rules targeting critical infrastructure vulnerabilities. These include an unauthenticated memory disclosure flaw in Citrix NetScaler ADC and Gateway (CVE-2026-8451) and a high-severity pre-authentication remote code execution (RCE) vulnerability in Progress Kemp LoadMaster (CVE-2026-8037).\n\nKey Findings\n\n- CVE-2026-8451: An insufficient input validation vulnerability affects Citrix NetScaler ADC and NetScaler Gateway appliances configured as a SAML Identity Provider (IdP). Remote, unauthenticated attackers can exploit this flaw by sending malformed requests to trigger a memory overread, allowing them to leak chunks of sensitive data from adjacent appliance memory.\n- CVE-2026-8037: A critical OS command injection vulnerability in Progress Kemp LoadMaster load balancers allows unauthenticated remote attackers to achieve remote code execution (RCE).\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...76973ac4 | N/A | Citrix Netscaler ADC - Insufficient Input Validation - CVE:CVE-2026-8451 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...10233f36 | N/A | Progress Kemp LoadMaster - Remote Code Execution - CVE:CVE-2026-8037 | Log | Block | This is a new detection. |","published_at":"2026-07-14T18:42:44+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}