---
id: "CVE-2026-8451"
kind: "vulnerability"
aliases: ["CVE-2026-8451"]
title: "Citrix NetScaler: malformed SAML requests leak memory from appliances"
severity: "high"
cvss: 8.8
epss: 0.00502
exploited: false
status: "open"
category: "vendor"
products: [{"name": "citrix netscaler application delivery controller", "fixed": ["13.1-37.272"], "affected": "< 13.1-37.272", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": ["13.1-63.18"], "affected": ">= 13.1, < 13.1-63.18", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": ["14.1-72.61"], "affected": ">= 14.1, < 14.1-72.61", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": [], "affected": "= 14.1-66.68", "ecosystem": "vendor"}, {"name": "citrix netscaler gateway", "fixed": ["13.1-63.18"], "affected": ">= 13.1, < 13.1-63.18", "ecosystem": "vendor"}, {"name": "citrix netscaler gateway", "fixed": ["14.1-72.61"], "affected": ">= 14.1, < 14.1-72.61", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["appliance", "citrix", "cloudflare", "lab-disclosure", "netscaler", "saml-idp", "self-hosted", "vendor"]
not_affected_if: ["managed-hosting", "not-saml-idp"]
published_at: "2026-06-30T13:19:33+00:00"
first_seen_at: "2026-10-24T18:43:45+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "lab", "url": "https://developers.cloudflare.com/changelog/post/2026-07-14-waf-release/", "first_seen_at": "2026-10-24T18:43:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8451", "first_seen_at": "2026-10-24T18:53:56+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-8451", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# Citrix NetScaler: malformed SAML requests leak memory from appliances

NetScaler ADC and NetScaler Gateway appliances configured as a SAML Identity Provider mishandle malformed requests and overread adjacent memory. A remote, unauthenticated attacker can leak chunks of sensitive data from the appliance's memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:citrix netscaler application delivery controller affected < 13.1-37.272 fixed 13.1-37.272
- vendor:citrix netscaler application delivery controller affected >= 13.1, < 13.1-63.18 fixed 13.1-63.18
- vendor:citrix netscaler application delivery controller affected >= 14.1, < 14.1-72.61 fixed 14.1-72.61
- vendor:citrix netscaler application delivery controller affected = 14.1-66.68 fixed ?
- vendor:citrix netscaler gateway affected >= 13.1, < 13.1-63.18 fixed 13.1-63.18
- vendor:citrix netscaler gateway affected >= 14.1, < 14.1-72.61 fixed 14.1-72.61

## How to check

- Check whether the appliance is configured as a SAML Identity Provider (IdP); the sources do not name the exact setting, so confirm in the NetScaler configuration.
- Check the running build against the affected versions listed in the Citrix bulletin CTX696604 (`13.1-37.272`, `13.1-63.18`, `14.1-72.61`).
- Check that the appliance is reachable from the internet.

## Fix

- Move NetScaler ADC and NetScaler Gateway to a fixed build: `13.1-63.18` on the 13.1 train or `14.1-72.61` on the 14.1 train, per Citrix bulletin CTX696604.
- Until patched, rely on the Cloudflare WAF rule for Citrix NetScaler ADC - Insufficient Input Validation - CVE:CVE-2026-8451 if the traffic passes through Cloudflare; this is a mitigation, not a fix.

## Timeline

- 2026-10-24T18:43:45+00:00 lab https://developers.cloudflare.com/changelog/post/2026-07-14-waf-release/ — Cloudflare: WAF Release - 2026-07-14 · Changelog
- 2026-10-24T18:53:56+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-8451
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-8451

## Documents

- [advisory] Citrix bulletin CTX696604 (CVE-2026-8451, -8452, -8655, -10816, -10817, -13474) https://support.citrix.com/external/article/CTX696604
- [advisory] Cloudflare: WAF Release - 2026-07-14 · Changelog https://developers.cloudflare.com/changelog/post/2026-07-14-waf-release/

## From the sources

WAF Release - 2026-07-14 · Changelog

# Changelog

New updates and improvements at Cloudflare.

July 14, 2026

## WAF Release - 2026-07-14

This release introduces new rules targeting critical infrastructure vulnerabilities. These include an unauthenticated memory disclosure flaw in Citrix NetScaler ADC and Gateway (CVE-2026-8451) and a high-severity pre-authentication remote code execution (RCE) vulnerability in Progress Kemp LoadMaster (CVE-2026-8037).

Key Findings

- CVE-2026-8451: An insufficient input validation vulnerability affects Citrix NetScaler ADC and NetScaler Gateway appliances configured as a SAML Identity Provider (IdP). Remote, unauthenticated attackers can exploit this flaw by sending malformed requests to trigger a memory overread, allowing them to leak chunks of sensitive data from adjacent appliance memory.
- CVE-2026-8037: A critical OS command injection vulnerability in Progress Kemp LoadMaster load balancers allows unauthenticated remote attackers to achieve remote code execution (RCE).

| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
| --- | --- | --- | --- | --- | --- | --- |
| Cloudflare Managed Ruleset | ...76973ac4 | N/A | Citrix Netscaler ADC - Insufficient Input Validation - CVE:CVE-2026-8451 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...10233f36 | N/A | Progress Kemp LoadMaster - Remote Code Execution - CVE:CVE-2026-8037 | Log | Block | This is a new detection. |

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_