Security Intelligence
Loading table of contents...
At a glance:
-
Open-source reporting indicates CVE-2026-8452 is being exploited in the wild following the release of public proof-of-concept exploit code.
-
The vulnerability affects Citrix NetScaler ADC and NetScaler Gateway deployments configured as a Gateway or Authentication, Authorization, and Accounting (AAA) virtual server and was patched on June 30, 2026.
-
Citrix describes the issue as a memory overflow vulnerability, while watchTowr researchers demonstrated a path to pre-authentication remote code execution on vulnerable systems.
Threat summary
On August 17, 2026, the Canadian Centre for Cyber Security reported indications that a recently patched vulnerability affecting Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway is being exploited in the wild. The report followed the publication of a technical analysis and proof-of-concept (PoC) exploit by watchTowr Labs a few days earlier.
Citrix NetScaler ADC and NetScaler Gateway are widely used to provide application delivery, load balancing, Secure Sockets Layer (SSL) offloading, federated authentication, and remote access services. Because these systems are often deployed at the network perimeter, they commonly provide remote users, contractors, and third parties with access to internal applications and services.
Citrix describes the flaw, CVE-2026-8452, as a memory overflow vulnerability affecting Gateway and Authentication, Authorization, and Accounting (AAA) virtual server deployments.
watchTowr's analysis indicates the vulnerability resides in NetScaler's handling of Security Assertion Markup Language (SAML) authentication messages. A specially crafted SAML message can trigger a memory corruption condition during signature validation when attacker-controlled data is copied into a fixed-size buffer without adequate size checks.
Citrix states that the vulnerability can result in denial of service and other unintended behavior. watchTowr subsequently demonstrated that the same vulnerability can be leveraged to achieve pre-authentication remote code execution against a vulnerable NetScaler appliance in a laboratory environment.
Citrix assigned the flaw a CVSS v4.0 score of 8.8, while the National Vulnerability Database (NVD) lists a CVSS v3.1 score of 9.8.
Affected versions include NetScaler ADC and NetScaler Gateway 14.1 releases before 14.1-72.61 and 13.1 releases before 13.1-63.18.
Citrix released security updates addressing the vulnerability on June 30, 2026.
Analysis
NetScaler appliances have a history of attracting threat actor interest because they often serve as a trusted entry point into enterprise environments.
Previous vulnerabilities affecting the platform, including CVE-2023-3519, were widely targeted following public disclosure due to the access these systems provide to internal applications and services.
The highest exposure is likely among organizations using NetScaler for remote access and federated authentication. Because affected systems often sit between external users and internal resources, a successful compromise could provide an adversary with access to a critical authentication and access management component.
Mitigations
Organizations are advised to identify NetScaler appliances providing VPN, SAML, single sign-on, or AAA services and determine whether they fall within the affected deployment scenarios identified by Citrix. Software versions can then be verified and vulnerable appliances upgraded to supported fixed releases.
Internet-facing NetScaler systems can also be reviewed for unexpected administrative activity, unauthorized configuration changes, and unusual authentication events that may indicate exploitation attempts or compromise.
Stay on top of emerging threats like this.
Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities.
