---
id: "CVE-2026-8452"
kind: "vulnerability"
aliases: ["CVE-2026-8452"]
title: "Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Citrix NetScaler ADC and NetScaler Gateway", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "NetScaler ADC and NetScaler Gateway", "fixed": ["14.1-72.61", "13.1-63.18", "14.1-72.61 FIPS", "13.1-37.272"], "affected": ">= 14.1, < 14.1-72.61; >= 13.1, < 13.1-63.18; 14.1-FIPS < 14.1-72.61 FIPS; 13.1-FIPS and NDcPP < 13.1-37.272", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": ["13.1-37.272"], "affected": "< 13.1-37.272", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": ["13.1-63.18"], "affected": ">= 13.1, < 13.1-63.18", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": ["14.1-72.61"], "affected": ">= 14.1, < 14.1-72.61", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": [], "affected": "= 14.1-66.68", "ecosystem": "vendor"}, {"name": "citrix netscaler gateway", "fixed": ["13.1-63.18"], "affected": ">= 13.1, < 13.1-63.18", "ecosystem": "vendor"}, {"name": "citrix netscaler gateway", "fixed": ["14.1-72.61"], "affected": ">= 14.1, < 14.1-72.61", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["citrix", "exploited", "gateway", "netscaler", "saml", "self-hosted", "vendor", "vpn"]
not_affected_if: ["managed-hosting", "no-gateway-or-aaa-vserver"]
published_at: "2026-06-30T13:19:33+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:52+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-8452", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:40:25+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8452", "first_seen_at": "2026-10-23T23:44:52+00:00"}]
---

# Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and…

Memory overflow (CWE-119) in NetScaler ADC/Gateway. Citrix describes it as DoS/unpredictable behaviour, CVSS v4 8.8. It is reachable when the appliance is a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA vserver. CISA KEV lists it as exploited. watchTowr published a pre-auth RCE writeup and PoC that it believes is this CVE, but Citrix does not map CVEs to researchers, so the link is unconfirmed. The NHS reports exploitation attempts after the PoC. Citrix-managed cloud services are patched by Citrix; this applies to customer-managed appliances.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Citrix NetScaler ADC and NetScaler Gateway affected ? fixed ?
- vendor:NetScaler ADC and NetScaler Gateway affected >= 14.1, < 14.1-72.61; >= 13.1, < 13.1-63.18; 14.1-FIPS < 14.1-72.61 FIPS; 13.1-FIPS and NDcPP < 13.1-37.272 fixed 14.1-72.61, 13.1-63.18, 14.1-72.61 FIPS, 13.1-37.272
- vendor:citrix netscaler application delivery controller affected < 13.1-37.272 fixed 13.1-37.272
- vendor:citrix netscaler application delivery controller affected >= 13.1, < 13.1-63.18 fixed 13.1-63.18
- vendor:citrix netscaler application delivery controller affected >= 14.1, < 14.1-72.61 fixed 14.1-72.61
- vendor:citrix netscaler application delivery controller affected = 14.1-66.68 fixed ?
- vendor:citrix netscaler gateway affected >= 13.1, < 13.1-63.18 fixed 13.1-63.18
- vendor:citrix netscaler gateway affected >= 14.1, < 14.1-72.61 fixed 14.1-72.61

## How to check

Run 'show running config' and search for 'add vpn vserver' (Gateway, ICA Proxy, CVPN, RDP Proxy) or 'add authentication vserver' (AAA). If either is present, the appliance meets the precondition. Also check the version with 'show version' against the affected builds. NetScaler Console: Security Advisory > CVE Detection > Impacted Instances, search CVE-2026-8452. If the appliance uses SAML SP/IdP ('add authentication samlIdPProfile' or SAML actions), treat it as exposed to the watchTowr PoC.

## Fix

Upgrade to 14.1-72.61 or later (14.1), 13.1-63.18 or later (13.1), 14.1-72.61 FIPS or later (14.1-FIPS), or 13.1-37.272 or later (13.1-FIPS and NDcPP). No workaround is listed in the bulletin. CISA advises checking for compromise and preserving forensics before patching. Secure Private Access Hybrid deployments using NetScaler also need the upgrade.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-8452
- 2026-10-23T21:40:25+00:00 analyst — Citrix bulletin CTX696604 read: affected/fixed builds and config checks. Exploitation: CISA KEV (Aug 26 2026) per Cyber Centre; public PoC per NHS. Citrix calls it DoS; watchTowr believes (unconfirmed) it is a pre-auth RCE reachable via SAML SP/IdP. The CISA Sept alert covers different CVE ids, so it was not linked. X had 1 post, no useful discussion.
- 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-8452

## Documents

- [advisory] Citrix bulletin CTX696604 (CVE-2026-8451, -8452, -8655, -10816, -10817, -13474) https://support.citrix.com/external/article/CTX696604
- [discussion] NHS England: Active exploitation of CVE-2026-8452 https://digital.nhs.uk/cyber-alerts/2026/cc-4832
- [mentions] Canadian Cyber Centre AV26-645 (exploitation, KEV Aug 26 2026) https://www.cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-645
- [poc] watchTowr: You're Back In The Room (NetScaler pre-auth RCE, CVE-2026-8452(?)) https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452/

## From the sources

Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_