CVE-2026-8452
Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Aug 26, 2026
- US federal agencies must remediate it by Aug 29, 2026 (BOD 22-01)
- First attack observed 47 days after disclosure
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source: CISA KEV · Sep 8, 2026 Aug 26, 2026 Aug 17, 2026 Aug 17, 2026 Aug 17, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
| Vendors | Product | Versions |
|---|---|---|
| citrix | netscaler application delivery controller | < 13.1-37.272 |
| citrix | netscaler gateway | < 13.1-63.18 |
Related articles
NetScaler SAML Deployments Face RCE and Crash Risk From CVE-2026-107406
Reported CVE-2026-107406 memory overflow in SAML-configured NetScaler ADC and Gateway may allow RCE or crashes, varying by build and IdP/SP role.
FortiMail and NetScaler Exploitation Drives an Urgent Enterprise Patch Cycle
FortiMail path traversal and NetScaler SAML flaw under active exploit join CISA KEV, forcing urgent patching plus PHP, PaperCut and Spectre fixes.
NetScaler SAML Deployments Need a Second Upgrade After CVE-2026-88779 Attacks
Citrix fixed NetScaler CVE-2026-88779 SAML memory flaw causing DoS. Check SAML configs and upgrade to 14.1-73.41 or 13.1-64.28 amid active attacks.
NetScaler Zero-Days Put Patch Speed and Shutdown Advice to the Test
Citrix patched eight NetScaler flaws, including two exploited zero-days, sparking debate over immediate upgrades versus taking systems offline.
NetScaler Attack Payloads Aim for Superuser Persistence and CSS-Masked Web Shells
Attackers exploit CVE-2026-88771 on NetScaler to deploy reverse shells, create sec_monitor superuser, steal configs and hide PHP web shells as CSS.
NetScaler Intrusions Turn a Gateway Flaw Into Root-Level Network Access
Mandiant links CVE-2026-88772 to NetScaler attacks granting root access, web shells, and internal network tunnels across dozens of orgs.
Citrix NetScaler Exploits Turn Edge Appliances Into Root-Level Network Tunnels
Citrix confirms active NetScaler exploits CVE-2026-88771 and CVE-2026-88772 enabling root access, web shells and network tunneling.
Citrix Patches Two NetScaler Zero-Days After Attackers Breach Unmitigated Systems
Citrix patched CVE-2026-88771 and CVE-2026-88772 (CVSS 9.5) in NetScaler ADC/Gateway after active exploitation. Learn affected versions and fixed builds.
Citrix NetScaler Operators Face Unverified Zero-Day Threat With No Patch or Detection Clues
WatchTowr reports two unpatched NetScaler ADC RCE flaws with no CVE, patch, or IoCs. Learn risks, affected versions, and guidance for operators.
Citrix NetScaler: Exploitation Attempts Target Critical Vulnerability CVE-2026-19490
Attackers target CVE-2026-19490, a NetScaler ADC and Gateway auth bypass. PoC attempts seen from 3 countries. Patch vulnerable AAA, VPN configs now.
An ownCloud flaw allowed theft of Philippine nuclear data: CISA adds it to KEV
On August 27, 2026, CISA added three new vulnerabilities to the Known Exploited Vulnerabilities KEV catalog. The most severe is CVE-2023-49105, an
ZBT: Two New Factory Implants in Chinese Routers Expose Remote Root Access
On August 28, 2026, The Hacker News confirmed through the IEEE registered MAC prefix database that the blocks 78:A3:51 and F8:5E:3C belong to Shenzhen
This product uses the NVD API but is not endorsed or certified by the NVD.