Tia N.List

KEV candidates · per-CVE timeline

CVE-2026-8451 7.5
Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML ID · Disclosed 2026-06-30
Exploitation reported Automatable KEV candidate

Timeline

  1. disclosed

    2026-06-30

    CVE published by the CNA / NVD. 1 day before Tia's first report.

  2. first reported

    2026-07-01

    1 story: first exploitation report 2 days later.

    Citrix NetScaler Memory Disclosure Flaw (CVE-2026-8451) — Shares Root Cause with CitrixBleed

  3. first exploitation report

    2026-07-03

    1 flagged event:

    2026-07-03 · securityweek.com

  4. KEV added

    not yet

    Not on the CISA KEV catalog yet — this is a live candidate.

Details

VulnerabilityInsufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML ID
Published2026-06-30
Modified2026-07-01
CWECWE-125
CVSS v3.17.5 HIGH · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Compliance SSVC + BOD 26-04

Automatableyes
Technical impacttotal
SSVC exploitationnone

If this were a KEV today — BOD 26-04 remediation

Publicly exposed3 days · due 2026-10-17
Internal only60 days · due 2026-12-13

Hypothetical: CISA's SSVC decision applied through BOD 26-04 Table 1 as if the CVE were listed today.

Exploitation reports

Events in the store flagged with an exploitation claim for this CVE (source: triage or deterministic backfill).

2026-07-03 · securityweek.com · source

CitrixBleed-Like Vulnerability (CVE-2026-8451) Exploited Within 24 Hours of Disclosure — Two Threat Actor Groups Scanning NetScaler Instances

NVD record

Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML IDP

Referenceshttps://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604

NVD detail page

"First exploitation report" is a reporting date, not the true first exploitation. KEV deltas use CISA's catalog date (dateAdded). Exploitation flags come from the deterministic backfill (source "backfill") or the hourly triage gate (source "triage"); the SSVC exploitation field is CISA's own assessment and can differ from Tia's reporting.

Source on GitHub