NetScaler CVE-2026-8451 Exploited Within 24 Hours of Disclosure
Summary
Lupovis reports threat actors probed exposed NetScaler appliances and delivered a payload within 24 hours of CVE-2026-8451’s disclosure. The unauthenticated memory-disclosure flaw affects appliances configured as SAML IdP.
Key points
- Citrix disclosed CVE-2026-8451 on June 30 and released patches; the vulnerability has a CVSS score of 8.8.
- The out-of-bounds read affects NetScaler ADC and Gateway appliances configured as SAML IdP and can disclose memory through the NSC_TASS cookie.
- The flaw is in NetScaler’s XML parser, which may read beyond a buffer when an unquoted XML attribute value is followed by a newline.
- Lupovis reports that threat actors began probing exposed appliances less than 24 hours after public disclosure and delivered a payload after receiving a matching 200 response.
- A second actor was later observed probing exposed NetScaler instances, according to Lupovis.
- Organizations are advised to patch immediately or disable SAML IdP if they cannot patch; suggested checks include /saml/login traffic, request values, and NSC_TASS cookie values.
Article Details
- Vulnerability Types
- Out-of-bounds read
- Severity
- CVSS 8.8
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Disable SAML IDP if patching is not possible.
MITRE ATT&CK
CVE
People
Vendors
Products
NetScaler ADCThreat actors began exploiting the latest CitrixBleed-like vulnerability in NetScaler ADC and NetScaler Gateways less than 24 hours after public disclosure, Scottish cybersecurity firm Lupovis reports.NetScaler GatewaysThreat actors began exploiting the latest CitrixBleed-like vulnerability in NetScaler ADC and NetScaler Gateways less than 24 hours after public disclosure, Scottish cybersecurity firm Lupovis reports.