1. Home
  2. Vulnerabilities
  3. CVE-2026-8452
Known Exploited Vulnerability
9.8
CRITICAL CVSS 3.1
CVE-2026-8452
Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability - [Actively Exploited]
Overview
Description

Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server

Details
INFO

Published Date :

June 30, 2026, 1:19 p.m.

Last Modified :

Aug. 27, 2026, 4:18 a.m.

Remotely Exploit :

Yes !

Source :

50a63c94-1ea7-4568-8c11-eb79e7c5a2b5
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service.

Required Action :

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Known Ransomware Campaign Use:

Unknown

Notes :

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-8452

Impact
Affected Products

The following products are affected by CVE-2026-8452 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Citrix netscaler_application_delivery_controller
2 Citrix netscaler_gateway
: Total Affected Vendor : 1 | Products : 2
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 134c704f-9b21-4f2e-91b3-4a467353bcc0
CVSS 3.1 CRITICAL [email protected]
CVSS 4.0 HIGH 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5
CVSS 4.0 HIGH 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5
Solution
Address memory overflow by applying security updates. Mitigate risk with stricter access controls.
  • Apply relevant security updates from the vendor.
  • Review and restrict access to Gateway/AAA configurations.
  • Monitor appliance behavior for anomalies.
  • Consider disabling specific Gateway features if vulnerable.
Public PoC/Exploit Available at Github

CVE-2026-8452 has a 1 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-8452.

URL Resource
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604 Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8452 US Government Resource
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-8452 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-8452 weaknesses.

CAPEC-8: Buffer Overflow in an API Call Buffer Overflow in an API Call CAPEC-9: Buffer Overflow in Local Command-Line Utilities Buffer Overflow in Local Command-Line Utilities CAPEC-10: Buffer Overflow via Environment Variables Buffer Overflow via Environment Variables CAPEC-14: Client-side Injection-induced Buffer Overflow Client-side Injection-induced Buffer Overflow CAPEC-24: Filter Failure through Buffer Overflow Filter Failure through Buffer Overflow CAPEC-42: MIME Conversion MIME Conversion CAPEC-44: Overflow Binary Resource File Overflow Binary Resource File CAPEC-45: Buffer Overflow via Symbolic Links Buffer Overflow via Symbolic Links CAPEC-46: Overflow Variables and Tags Overflow Variables and Tags CAPEC-47: Buffer Overflow via Parameter Expansion Buffer Overflow via Parameter Expansion CAPEC-100: Overflow Buffers Overflow Buffers CAPEC-123: Buffer Manipulation Buffer Manipulation

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
derekpreston81/CVE_ADC_IOC_2026

Citrix NetScaler CVE Preconditions Checker as per CTX696604 | Supported CVE : CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, and CVE-2026-13474

Python

Updated: 2 months ago
1 stars 0 fork 0 watcher
Born at : June 30, 2026, 10:15 p.m. This repo has been linked 6 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-8452 vulnerability anywhere in the article.

  • The Hacker News
CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added six flaws to its Known Exploited Vulnerabilities (KEV) catalog, including a high-severity security vulnerability imp ... Read more

Published Date: Aug 27, 2026 (3 days, 15 hours ago)
  • TheCyberThrone
CISA Adds Six Actively Exploited Vulnerabilities to KEV on Aug 26 2026

On August 26, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitat ... Read more

Published Date: Aug 27, 2026 (3 days, 19 hours ago)
  • security.nl
Kritieke Citrix NetScaler RCE-kwetsbaarheid misbruikt bij aanvallen

dinsdag 18 augustus 2026, 10:20 door Redactie, 1 reactiesLaatst bijgewerkt: Vandaag, 12:02 Een kritieke kwetsbaarheid in Citrix NetScaler ADC en Citrix NetScaler Gateway die remote code execution (RCE ... Read more

Published Date: Aug 18, 2026 (1 week, 5 days ago)
  • security.nl
Kritiek Citrix NetScaler-lek maakt ook remote code execution mogelijk

Een kritieke kwetsbaarheid in Citrix NetScaler ADC en Citrix NetScaler Gateway blijkt ook remote code execution door een ongeauthenticeerde aanvaller mogelijk te maken, wat grote gevolgen voor organis ... Read more

Published Date: Aug 14, 2026 (2 weeks, 2 days ago)
  • TheCyberThrone
Citrix Fixes 6 Vulnerabilities in NetScaler

July 3, 2026Citrix has released security updates for its widely deployed NetScaler ADC and NetScaler Gateway, patching six vulnerabilities that could expose organizations to arbitrary file reads, memo ... Read more

Published Date: Jul 03, 2026 (1 month, 3 weeks ago)
  • The Hacker News
Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service

Citrix on Tuesday released security updates to address multiple flaws in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) that could be exploited by an attacker to f ... Read more

Published Date: Jul 01, 2026 (1 month, 4 weeks ago)

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-8452 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Aug. 27, 2026

    Action Type Old Value New Value
    Changed SSVC {'id': 'CVE-2026-8452', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'active'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-26T17:44:29.767073Z'} {'id': 'CVE-2026-8452', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'active'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-26T00:00:00+00:00'}
  • Modified Analysis by [email protected]

    Aug. 26, 2026

    Action Type Old Value New Value
    Added Reference Type CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8452 Types: US Government Resource
  • CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725

    Aug. 26, 2026

    Action Type Old Value New Value
    Added Date Added 2026-08-26
    Added Due Date 2026-08-26
    Added Required Action 2026-08-26
    Added Vulnerability Name 2026-08-26
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Aug. 26, 2026

    Action Type Old Value New Value
    Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8452
    Changed SSVC {'id': 'CVE-2026-8452', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-30T13:36:43.132060Z'} {'id': 'CVE-2026-8452', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'active'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-26T17:44:29.767073Z'}
  • CVE Modified by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

    Aug. 26, 2026

    Action Type Old Value New Value
    Added Reference https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604
    Removed Reference https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604
    Removed Reference Type https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604 Types: Vendor Advisory
  • Initial Analysis by [email protected]

    Jul. 01, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Added CPE Configuration OR *cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* versions from (including) 13.1 up to (excluding) 13.1-63.18 *cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* versions from (including) 14.1 up to (excluding) 14.1-72.61 *cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:* versions up to (excluding) 13.1-37.272 *cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:* versions up to (excluding) 13.1-37.272 *cpe:2.3:a:citrix:netscaler_application_delivery_controller:14.1-66.68:*:*:*:fips:*:*:* *cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* versions from (including) 13.1 up to (excluding) 13.1-63.18 *cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* versions from (including) 14.1 up to (excluding) 14.1-72.61
    Added Reference Type NetScaler: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604 Types: Vendor Advisory
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Jun. 30, 2026

    Action Type Old Value New Value
    Added CWE CWE-119
    Added SSVC {'id': 'CVE-2026-8452', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-30T13:36:43.132060Z'}
  • New CVE Received by 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

    Jun. 30, 2026

    Action Type Old Value New Value
    Added Affected [{'vendor': 'NetScaler', 'product': 'ADC', 'versions': [{'status': 'affected', 'version': '14.1', 'lessThan': '72.61', 'versionType': 'patch'}, {'status': 'affected', 'version': '13.1', 'lessThan': '63.18', 'versionType': 'patch'}, {'status': 'affected', 'version': '14.1 FIPS', 'lessThan': '72.61', 'versionType': 'patch'}, {'status': 'affected', 'version': '13.1 FIPS and NDcPP', 'lessThan': '37.272', 'versionType': 'patch'}], 'defaultStatus': 'unaffected'}, {'vendor': 'NetScaler', 'product': 'Gateway', 'versions': [{'status': 'affected', 'version': '14.1', 'lessThan': '72.61', 'versionType': 'patch'}, {'status': 'affected', 'version': '13.1', 'lessThan': '63.18', 'versionType': 'patch'}], 'defaultStatus': 'unaffected'}]
    Added Description Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server
    Added CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
    Added Reference https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS
Vulnerability Scoring Details
Base CVSS Score: 8.8
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability
Base CVSS Score: 9.8
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact