CVE-2026-8452

What is NetScaler ADC / Gateway?

Citrix NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway are application-delivery controllers and remote-access appliances that sit at the network edge, providing load balancing, SSL/TLS termination, and SSL-VPN / ICA-proxy access into corporate environments. Because they are internet-facing, terminate authentication for remote workers, and bridge into internal networks, NetScaler appliances have been among the most heavily targeted enterprise devices in recent years (the "Citrix Bleed" lineage). A pre-authentication memory-corruption flaw here is a direct route to remote code execution on the edge of the network.

Overview

CVE-2026-8452 is a pre-authentication memory-overflow vulnerability (CWE-119, improper restriction of operations within the bounds of a memory buffer) in NetScaler's SAML single-sign-on processing. A remote, unauthenticated attacker can send a single crafted SAML/HTTP message that overflows a fixed-size buffer during signature canonicalization — before the signature is validated — corrupting adjacent packet-engine heap state. Depending on exploitation, this results in denial of service or, as demonstrated publicly, unauthenticated root remote code execution. NVD scores it CVSS 9.8 CRITICAL. Exploitation requires the appliance to be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server, with SAML configured.

Affected Versions

Technical Details

During XML signature canonicalization, NetScaler copies attacker-controlled data from the SAML <SignedInfo> element's PrefixList attribute into a fixed-size buffer with no bounds check. An oversized SignedInfo/PrefixList overflows adjacent packet-engine heap memory. Public analysis (watchTowr) showed the overflow can be shaped into a write-what-where primitive: corrupted heap-chunk metadata feeds a later memcpy in splitPktInner, enabling arbitrary writes; overwriting a function pointer (tx_pkt_complete_fptr) and redirecting execution to RWX heap shellcode — while disabling signal handlers to avoid the "pitboss" watchdog rebooting the appliance — yields unauthenticated root RCE. The attack is a single request, requires no authentication (AV:N/AC:L/PR:N/UI:N), and critically triggers before signature validation, so no valid SAML credentials are needed.

Discovery

The vulnerability was credited to Michael Tucker (XOR team, JPMorgan Chase), Aliz Hammond (watchTowr), and Maxim Suhanov. watchTowr Labs published the public technical write-up and proof of concept.

Exploitation Context

Exploitation is confirmed in the wild, beginning shortly after watchTowr's public analysis — reportedly within about 24 hours of the write-up. The Canadian Centre for Cyber Security reported active exploitation on 17 August 2026. No named APT has been attributed; activity appears opportunistic against exposed appliances. Given the "Citrix Bleed" history of NetScaler devices being mass-exploited, internet-facing appliances with SAML-enabled Gateway/AAA vServers should be treated as at immediate risk.

Remediation

1. Upgrade immediately to a fixed build: 14.1-72.61+, 13.1-63.18+, or 13.1.37.272+ (FIPS/NDcPP). This flaw was patched in Citrix bulletin CTX696604 alongside several other NetScaler CVEs.
2. Retire end-of-life versions (12.1, 13.0) — they receive no fix; migrate to a supported branch.
3. Assume compromise on any exposed, unpatched appliance. After patching, follow Citrix/CISA guidance: terminate active sessions, rotate credentials and secrets handled by the appliance, and review for persistence.
4. Hunt for exploitation indicators — crashes/reboots of the packet engine, anomalous SAML requests with oversized SignedInfo/PrefixList, and unexpected processes or files on the appliance.
5. Limit exposure of the management interface and restrict which vServers expose SAML where feasible.