{"id":"CVE-2026-8452","kind":"vulnerability","aliases":["CVE-2026-8452"],"related":[],"title":"Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and…","description":"Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Memory overflow (CWE-119) in NetScaler ADC/Gateway. Citrix describes it as DoS/unpredictable behaviour, CVSS v4 8.8. It is reachable when the appliance is a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA vserver. CISA KEV lists it as exploited. watchTowr published a pre-auth RCE writeup and PoC that it believes is this CVE, but Citrix does not map CVEs to researchers, so the link is unconfirmed. The NHS reports exploitation attempts after the PoC. Citrix-managed cloud services are patched by Citrix; this applies to customer-managed appliances.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-08-26T00:00:00+00:00","products":[{"name":"Citrix NetScaler ADC and NetScaler Gateway","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"NetScaler ADC and NetScaler Gateway","fixed":["14.1-72.61","13.1-63.18","14.1-72.61 FIPS","13.1-37.272"],"affected":">= 14.1, < 14.1-72.61; >= 13.1, < 13.1-63.18; 14.1-FIPS < 14.1-72.61 FIPS; 13.1-FIPS and NDcPP < 13.1-37.272","ecosystem":"vendor"},{"name":"citrix netscaler application delivery controller","fixed":["13.1-37.272"],"affected":"< 13.1-37.272","ecosystem":"vendor"},{"name":"citrix netscaler application delivery controller","fixed":["13.1-63.18"],"affected":">= 13.1, < 13.1-63.18","ecosystem":"vendor"},{"name":"citrix netscaler application delivery controller","fixed":["14.1-72.61"],"affected":">= 14.1, < 14.1-72.61","ecosystem":"vendor"},{"name":"citrix netscaler application delivery controller","fixed":[],"affected":"= 14.1-66.68","ecosystem":"vendor"},{"name":"citrix netscaler gateway","fixed":["13.1-63.18"],"affected":">= 13.1, < 13.1-63.18","ecosystem":"vendor"},{"name":"citrix netscaler gateway","fixed":["14.1-72.61"],"affected":">= 14.1, < 14.1-72.61","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["citrix","exploited","gateway","netscaler","saml","self-hosted","vendor","vpn"],"not_affected_if":["managed-hosting","no-gateway-or-aaa-vserver"],"how_to_check":"Run 'show running config' and search for 'add vpn vserver' (Gateway, ICA Proxy, CVPN, RDP Proxy) or 'add authentication vserver' (AAA). If either is present, the appliance meets the precondition. Also check the version with 'show version' against the affected builds. NetScaler Console: Security Advisory > CVE Detection > Impacted Instances, search CVE-2026-8452. If the appliance uses SAML SP/IdP ('add authentication samlIdPProfile' or SAML actions), treat it as exposed to the watchTowr PoC.","fix":"Upgrade to 14.1-72.61 or later (14.1), 13.1-63.18 or later (13.1), 14.1-72.61 FIPS or later (14.1-FIPS), or 13.1-37.272 or later (13.1-FIPS and NDcPP). No workaround is listed in the bulletin. CISA advises checking for compromise and preserving forensics before patching. Secure Private Access Hybrid deployments using NetScaler also need the upgrade.","status":"open","published_at":"2026-06-30T13:19:33+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:47+00:00","updated_at":"2026-10-23T23:44:52+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T20:31:47Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations and patches in accordance with Citrix vendor instructions, per CISA BOD 26-04; if mitigations are unavailable, discontinue use of the product as CISA directs.","summary":"Citrix NetScaler ADC and NetScaler Gateway contain a memory buffer bounds bug that can crash the appliance, causing denial of service. CISA lists it as actively exploited in the wild.","category":"vendor","who_cares":["netscaler","citrix","self-hosted","gateway"],"confidence":0.6,"analyst_note":"Source gives no affected or fixed versions and no check steps; find the Citrix security bulletin for CVE-2026-8452 and the fixed NetScaler build numbers.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"severity_if_unknown":"high"},"cost_usd":0.000378,"input_tokens":2259,"output_tokens":304,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Source gives no affected or fixed versions and no check steps; find the Citrix security bulletin for CVE-2026-8452 and the fixed NetScaler build numbers.","search":"'-04':207C,233C,264C '-119':71B '-2026':16A,19A '-8452':17A,20A '26':206C,232C,263C '8.8':83B 'aaa':102B 'accord':196C 'action':192C 'adc':5A,23A,28A,165C 'adc/gateway':74B 'adher':260C 'and':24A,29A 'appli':157B,193C 'applianc':89B,162B 'applic':230C 'application':34A,39A,44A,49A 'asset':254C 'attempt':143B 'auth':115B 'base':211C 'behavior':14A 'behaviour':80B 'believ':122B 'bod':205C,231C,262C 'bound':177C 'buffer':181C 'cisa':104B,190C,203C,220C 'citrix':21A,32A,37A,42A,47A,52A,55A,58B,75B,127B,148B,155B,163C 'citrix-manag':147B 'cloud':150B,236C 'complianc':201C 'contain':169C 'controller':36A,41A,46A,51A 'could':184C 'custom':160B 'customer-manag':159B 'cve':15A,18A,125B 'cves':131B 'cvpn':97B 'cvss':81B 'cwe':70B 'delivery':35A,40A,45A,50A 'denial':187C 'describ':76B 'discontinu':239C 'dos/unpredictable':79B 'ensur':200C,259C 'erron':13A 'evalu':252C 'exploit':59B,109B,142B 'exposur':257C 'follow':229C 'forens':222C 'gateway':8A,26A,31A,54A,57A,60B,92B,168C 'guidanc':218C,234C 'guidelin':266C 'host':65B 'ica':95B 'improp':171C 'instruct':199C 'internet':256C 'kev':105B 'lead':9A,185C 'link':136B 'list':106B 'manag':149B,161B 'map':130B 'memori':1A,68B,180C 'mitig':194C,245C 'netscal':4A,7A,61B,73B,164C,167C 'netscaler':22A,25A,27A,30A,33A,38A,43A,48A,53A,56A 'nhs':140B 'note':217C,228C 'oper':174C 'overflow':2A,69B 'patch':153B,265C 'poc':119B,146B 'pre':114B 'pre-auth':113B 'priorit':208C 'product':243C 'proxi':96B,99B 'publish':111B 'rce':116B 'rdp':98B 'reachabl':86B 'report':141B 'requir':191C,224C 'research':133B 'respons':250C 'restrict':172C 'risk':213C 'saml':62B 'secur':209C 'see':214C,225C 'self':64B 'self-host':63B 'servic':151B,189C,237C 'ssl':93B 'stakehold':248C 'triag':223C 'unavail':247C 'unconfirm':138B 'unpredict':11A 'updat':210C 'url':215C,226C 'use':240C 'v4':82B 'vendor':66B,198C 'vpn':67B,94B 'vserver':103B 'vulner':3A,182C 'watchtowr':110B 'within':175C 'writeup':117B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-30T13:19:33+00:00","kev":{"dateAdded":"2026-08-26","dueDate":"2026-08-29","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"50a63c94-1ea7-4568-8c11-eb79e7c5a2b5","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2026-8452","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-8452","severity":null,"published_at":"2026-08-26T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-8452:128","url":null,"severity":null,"published_at":"2026-10-23T21:40:25+00:00","modified_at":"2026-10-23T21:40:25+00:00","first_seen_at":"2026-10-23T21:40:25+00:00","fetched_at":"2026-10-23T21:40:25+00:00","note":"Citrix bulletin CTX696604 read: affected/fixed builds and config checks. Exploitation: CISA KEV (Aug 26 2026) per Cyber Centre; public PoC per NHS. Citrix calls it DoS; watchTowr believes (unconfirmed) it is a pre-auth RCE reachable via SAML SP/IdP. The CISA Sept alert covers different CVE ids, so it was not linked. X had 1 post, no useful discussion."},{"source":"nvd","external_id":"CVE-2026-8452","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8452","severity":null,"published_at":"2026-06-30T13:19:33+00:00","modified_at":"2026-08-27T04:18:00+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":1183,"url":"https://support.citrix.com/external/article/CTX696604","title":"Citrix bulletin CTX696604 (CVE-2026-8451, -8452, -8655, -10816, -10817, -13474)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1185,"url":"https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452/","title":"watchTowr: You're Back In The Room (NetScaler pre-auth RCE, CVE-2026-8452(?))","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1186,"url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4832","title":"NHS England: Active exploitation of CVE-2026-8452","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null},{"id":1188,"url":"https://www.cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-645","title":"Canadian Cyber Centre AV26-645 (exploitation, KEV Aug 26 2026)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}