H-ISAC TLP White Threat Bulletin: PoC Exploit Available for Citrix NetScaler ADC and Gateway CVE-2026-8452

Additional Info

Analysis

CVE-2026-8452 is a memory overflow vulnerability affecting appliances configured as a Gateway or AAA virtual server, which can lead to unpredictable behavior or a Denial of Service (DoS) attack.

With their PoC exploit, watchTowr demonstrated that the flaw, triggered by missing bounds checks during SAML signature canonicalization when copying data, can be weaponized as a write-what-where memory corruption primitive to achieve unauthenticated root code execution.

The issue affects customer-managed NetScaler appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server, running 14.1 builds prior to 14.1-72.61, 13.1 builds prior to 13.1-63.18, and corresponding FIPS/NDcPP releases.

Although Citrix patched its managed cloud services beforehand and no active exploitation in the wild has been confirmed yet, the public availability of exploit code increases the chances of an attack for edge-facing enterprise appliances.

View the detailed report below.