CVE-2026-8452

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-8452 9.8

Citrix · NetScaler ADC and NetScaler Gateway · Added 2026-08-26 · Published 2026-06-30

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityCitrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

VendorCitrix

ProductNetScaler ADC and NetScaler Gateway

Date added2026-08-26

Due date2026-08-29

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-119

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Descriptions

KEV: Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service.

NVD: Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server

Compliance SSVC + BOD 26-04

Automatableyes

Technical impactpartial

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days

Non-public timeline14 days

Forensic (public)Not required

Forensic (non-public)Not required

Research metadata

Last researched2026-08-26 18:41 UTC

Searches3

Component defaultunknown

Sources https://support.citrix.com/external/article/CTX696604/netscaler-adc-and-netscaler-gateway-secu.html
https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452
https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452/
https://securityonline.info/citrix-netscaler-pre-auth-rce-cve-2026-8452/

Hunting hypothesis agent

Hunt HTTP access logs for SAML Responses to NetScaler AAA or Gateway vServers with oversized ds:PrefixList attributes (~60 space-separated tokens), and monitor nsppe for SIGBUS/SIGSEGV crashes in SignedInfo canonicalization.

Research details

Componentnsppe SAML SignedInfo canonicalization PrefixList handler

PreconditionsUnauthenticated network access to NetScaler appliance configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server with SAML enabled as SP or IdP; affected versions: 14.1 before 14.1-72.61, 13.1 before 13.1-63.18, 14.1-FIPS before 14.1-72.61 FIPS, 13.1-FIPS and NDcPP before 13.1-37.272 agent

DeliveryUnauthenticated SAML Response with oversized PrefixList in <ec:InclusiveNamespaces> containing ~60 space-separated tokens and embedded shellcode, sent to the NetScaler SAML SP/IdP endpoint; the heap overflow corrupts nsb chunk headers achieving a write-what-where primitive via jmp rax to shellcode that drops a PHP webshell at /var/vpn/theme/x.php.

Public PoCyes

PoC URLs https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452 Third-party repos; verify before use.

Advisoryhttps://support.citrix.com/external/article/CTX696604/netscaler-adc-and-netscaler-gateway-secu.html

Exploit notesPublic PoC exploit by watchTowr achieves full root RCE via SAML SignedInfo PrefixList heap overflow; exploit crafts oversized PrefixList in ds:SignedInfo element to overflow into adjacent nsb chunk header, corrupting data pointer to create write-what-where primitive, then overwrites tx_pkt_complete_fptr to hijack control flow to shellcode on executable heap; drops webshell at /var/vpn/theme/x.php; no ASLR or PIE on nsppe binary; exploit token pattern is M%07d repeated 5 times + N%06d repeated 60 times in the PrefixList attribute.

SummaryCitrix NetScaler ADC and Gateway contain a heap overflow in the SAML SignedInfo canonicalization handler within the nsppe packet processing engine. An unauthenticated attacker can send an oversized SignedInfo PrefixList element to corrupt adjacent heap metadata, achieving a write-what-where primitive that leads to arbitrary code execution as root. watchTowr published a full technical writeup and working PoC on August 14, 2026, demonstrating pre-auth RCE with a webshell dropped at /var/vpn/theme/x.php.

Tia coverage

First reported2025-08-26

First exploit report2026-08-27

Exploit report → KEV1 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

citrix-netscaler-unpatched-rce-zero-days

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.