Reported by 2 outlets

Timeline

1. original reporting

   Citrix NetScaler Memory Disclosure Flaw (CVE-2026-8451) — Shares Root Cause with CitrixBleed

   cyberscoop.com · 105d ago · July 1st, 2026

   Citrix disclosed six vulnerabilities in NetScaler ADC and NetScaler Gateway appliances (CVSS 6.9–8.8), including a high-severity memory disclosure flaw discovered by watchTowr that shares a root cause with the 2023 CitrixBleed vulnerability — out-of-bounds memory reads triggered by malformed SAML requests.

   CVE-2026-8451 affects NetScaler appliances configured as SAML identity providers for single sign-on. The bulletin also includes: two memory overflow DoS conditions, an unauthenticated arbitrary file read vulnerability (management interface exposed), a TCP timestamp memory overread, and an HTTP/2 DoS requiring manual configuration. NetScaler has amassed 20+ KEV entries in three years. No active exploitation confirmed at disclosure time.

   Recommended action: Patch to latest NetScaler builds. For the HTTP/2 DoS, manually configure the timeout parameter per Citrix guidance even after patching.

   ---

2. update from securityweek.com

   CitrixBleed-Like Vulnerability (CVE-2026-8451) Exploited Within 24 Hours of Disclosure — Two Threat Actor Groups Scanning NetScaler Instances

   securityweek.com · 103d ago · July 3rd, 2026

   Threat actors began exploiting CVE-2026-8451 (CVSS 8.8), an out-of-bounds read vulnerability in NetScaler ADC and Gateway appliances configured as SAML identity providers, less than 24 hours after public disclosure on June 30. Scottish security firm Lupovis reports that at least two distinct threat actors are now probing exposed NetScaler instances. Previously covered July 1 at disclosure. New today: Confirmed active exploitation by two groups within 24 hours of public PoC.

   The first scanning activity originated from an IP in Frankfurt, Germany, deploying a payload matching the overread variant from watchTowr's detection generator — a bare <samlp:AuthnRequest> tag padded with 476 spaces followed by a newline. A second actor was observed scanning from a Koapu Cloud HK IP address. Both groups probe for the SAML endpoint and deliver the exploit payload immediately upon receiving a 200 OK response. The flaw exists in NetScaler's XML parser, which fails to terminate unquoted XML attribute values followed by a newline character, causing the parser to read past the intended buffer and return memory contents in the NSC_TASS cookie. If patching is not possible, disable SAML IDP configuration. Monitor logs for /saml/login traffic and inspect NSC_TASS cookie values.