Citrix Patches Six NetScaler Flaws, Including SAML Memory Disclosure Bug
Summary
Citrix disclosed six NetScaler ADC and Gateway vulnerabilities. CVE-2026-8451 is a high-severity memory disclosure flaw involving SAML parsing; one HTTP/2-related fix requires a manual configuration change. No confirmed exploitation was reported at disclosure.
Key points
- Citrix disclosed six vulnerabilities affecting NetScaler ADC and NetScaler Gateway, with bulletin severity rated high and CVSS scores ranging from 6.9 to 8.8.
- CVE-2026-8451 is a high-severity memory disclosure flaw involving SAML authentication request parsing when NetScaler is configured as a SAML identity provider.
- WatchTowr said it found the flaw while reproducing CVE-2026-3055; both involve out-of-bounds memory reads triggered by malformed SAML requests.
- The five other flaws include denial-of-service conditions, unauthenticated arbitrary file reads on appliances with management access exposed on certain interfaces, and a memory overread involving TCP timestamp handling.
- One denial-of-service fix involving malformed HTTP/2 requests requires administrators to manually set a timeout parameter after patching.
- Citrix advised customers to install updated builds. The bulletin and WatchTowr writeup did not cite confirmed exploitation of CVE-2026-8451 at disclosure.
Article Details
- Vulnerability Types
- Memory disclosure
- Out-of-bounds memory read
- Memory overflow
- Denial of service
- Unauthenticated arbitrary file read
- Memory overread
- Severity
- High overall bulletin severity; CVSS scores across the six vulnerabilities range from 6.9 to 8.8.
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- For the HTTP/2-related denial-of-service flaw, administrators must explicitly set the relevant timeout parameter after patching.
CVE
People
Aliz HammondWatchTowr researcher who found CVE-2026-8451 while reproducing CVE-2026-3055 and wrote about the flaw.Maxim SuhanovCredited by the bulletin with finding vulnerabilities.Michael TuckerCredited by the bulletin with finding vulnerabilities; identified as a member of the XOR team at JPMorgan Chase.
Vendors
Products
NetScaler ADCCitrix disclosed six vulnerabilities in NetScaler ADC and NetScaler Gateway, including CVE-2026-8451, a high-severity memory disclosure flaw linked to the same class of issues behind CitrixBleed.NetScaler GatewayCitrix disclosed six vulnerabilities in NetScaler ADC and NetScaler Gateway, including CVE-2026-8451, a high-severity memory disclosure flaw linked to the same class of issues behind CitrixBleed.