CVE-2026-8452
Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Description
CVE-2026-8452 is a critical memory overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway that leads to unpredictable or erroneous behaviour and denial of service. The flaw is reachable when the appliance is configured as a Gateway — SSL VPN, ICA Proxy, CVPN or RDP Proxy — or as an AAA virtual server, which covers the great majority of production NetScaler deployments providing remote access. An unauthenticated remote attacker can trigger the buffer error without any credentials or user interaction. NetScaler ADC and Gateway are affected below 13.1-63.18 and 14.1-72.61, and below 13.1-37.272 on the FIPS/NDcPP line. CVE-2026-8452 carries a CVSS score of 9.8 and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog with a deadline that has already passed.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| citrix | netscaler application delivery controller | < 13.1-37.272; >= 13.1, < 13.1-63.18; >= 14.1, < 14.1-72.61; 14.1-66.68 |
| citrix | netscaler gateway | >= 13.1, < 13.1-63.18; >= 14.1, < 14.1-72.61 |
References
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8452(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
This is the parent category for buffer errors: software performs an operation on a memory buffer but can read from or write to a location outside the buffer's intended boundary. In CVE-2026-8452 the NetScaler Gateway and AAA virtual server code paths process attacker-supplied input without correctly restricting the operation to the allocated buffer, producing the memory overflow that Citrix describes as causing unpredictable or erroneous behaviour and denial of service.
Learn more: CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
Impact Analysis
CVE-2026-8452 is remotely exploitable over the network with low attack complexity, no authentication and no user interaction, so reaching the Gateway or AAA virtual server is the only precondition — and those services are internet-facing by design, since their purpose is to terminate remote access from outside the perimeter. The CVSS metrics record high impact to confidentiality, integrity and availability, reflecting that memory corruption can produce outcomes well beyond the denial of service the vendor description emphasises: "unpredictable or erroneous behaviour" in a buffer-handling defect is the language of a bug whose full consequences are not bounded. The availability dimension alone is serious, because taking down a NetScaler Gateway severs VPN and virtual desktop access for an entire workforce, and the confidentiality dimension matters because the appliance handles authentication traffic and session material for every remote user. The EPSS score of roughly 1.6% (74th percentile) is a moderate signal, but CISA's KEV listing confirms exploitation in the wild, with a remediation deadline of 29 August 2026 that has already expired.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2026-8452 by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of 29 August 2026 that has already passed, so internet-facing NetScaler appliances still running affected builds should be considered compromised rather than merely at risk. No public exploit code appears among the available references; Citrix advisory CTX696604 is the only vendor source, which is standard practice for pre-authentication memory-corruption flaws in widely deployed edge appliances. The EPSS score of about 1.6% (74th percentile) is moderate and likely understates reality, since EPSS reacts slowly to vulnerabilities exploited by capable actors before broad proof-of-concept release. Citrix NetScaler has an extensive track record as an initial access vector for both ransomware affiliates and state-aligned intrusion sets, and unauthenticated memory corruption on a remote access gateway is exactly the class of flaw those groups invest in, so the absence of published exploit code offers no reassurance.
Remediation
- Follow the CISA KEV required action immediately. Apply mitigations in accordance with Citrix's instructions, comply with CISA's BOD 26-04 "Prioritizing Security Updates Based on Risk" guidance and the "Forensics Triage Requirements", and discontinue use of the product if mitigations are unavailable. The KEV due date of 29 August 2026 has passed, so unpatched appliances are overdue.
- Upgrade to a fixed NetScaler build. Fixed versions are 13.1-63.18 and 14.1-72.61 and later, with 13.1-37.272 for the FIPS/NDcPP line; Citrix documents the affected and fixed builds in advisory CTX696604. Note that version 14.1-66.68 is explicitly listed as affected, so a recent build number is not by itself evidence of safety.
- Determine whether your configuration is exposed. The flaw is conditional on the appliance being configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server; inventory your virtual server configuration to confirm which appliances are in scope, and prioritise those terminating internet-facing remote access.
- Reduce exposure and prepare for instability while patching. Where an immediate upgrade is not possible, restrict which source networks can reach the Gateway and AAA virtual servers, and be aware that exploitation attempts may crash the appliance — ensure high-availability pairs are healthy, configuration backups are current, and monitoring will alert on unexpected restarts rather than silently failing over.
- Hunt for compromise and harden long term. Review NetScaler logs and crash dumps for repeated failures of the Gateway or AAA processes, which indicate exploitation attempts, check for unauthorised configuration changes, administrative accounts and sessions, and rotate appliance credentials, certificates and backend authentication secrets if compromise cannot be excluded; then keep the management interface (NSIP) off routable networks entirely and maintain an expedited patch process for perimeter appliances, which are consistently among the first targets after disclosure.
Technical Details
CVE-2026-8452 is a memory buffer error (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway. The affected code paths belong to the Gateway virtual server — serving SSL VPN, ICA Proxy, CVPN and RDP Proxy — and the AAA virtual server, both of which parse input arriving from unauthenticated clients as part of establishing remote access. A memory overflow in that processing means the code reads or writes outside the intended bounds of a buffer; Citrix characterises the result as unpredictable or erroneous behaviour and denial of service, wording that describes an observable crash without excluding more severe consequences from the underlying corruption. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H assigns high impact to all three security properties at unchanged scope, and combined with network reachability, low complexity and no privilege or interaction requirements this produces the 9.8 Critical rating. The dependency on virtual server configuration is the one mitigating factor: appliances used purely for load balancing without Gateway or AAA roles do not expose the vulnerable path.
Frequently Asked Questions
Is CVE-2026-8452 being actively exploited?
Yes. CISA added CVE-2026-8452 to its Known Exploited Vulnerabilities catalog with a remediation due date of 29 August 2026, confirming exploitation in the wild. Because that deadline has passed, any appliance still running an affected build should be treated as potentially already compromised rather than simply unpatched.
What products are affected by CVE-2026-8452?
Citrix NetScaler ADC and NetScaler Gateway are affected below 13.1-63.18 and below 14.1-72.61, and below 13.1-37.272 on the FIPS/NDcPP line; build 14.1-66.68 is also explicitly listed as affected. The vulnerability is only reachable when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server.
How do I fix CVE-2026-8452?
Upgrade NetScaler ADC and Gateway to 13.1-63.18, 14.1-72.61 or 13.1-37.272 or later according to Citrix advisory CTX696604. Confirm which of your appliances actually run Gateway or AAA virtual servers to prioritise correctly, restrict source networks that can reach those services in the interim, and review logs for repeated process crashes and unauthorised configuration changes.
How severe is CVE-2026-8452?
CVE-2026-8452 is Critical with a CVSS 3.1 base score of 9.8. It is unauthenticated, network-exploitable with low complexity and no user interaction, and carries high confidentiality, integrity and availability impact on an appliance that terminates remote access for an entire organisation; the vendor describes the outcome as unpredictable behaviour and denial of service, and confirmed KEV-listed exploitation past its deadline makes it an emergency patch.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.