CISA has added CVE-2026-8452 to its Known Exploited Vulnerabilities catalog and requires U.S. federal agencies to apply patches for Citrix NetScaler before 29 August 2026. The flaw, initially classified as a denial-of-service issue, is already being exploited in the wild to achieve unauthenticated remote code execution with root privileges on unpatched devices.
The vulnerability affects NetScaler ADC and NetScaler Gateway when the appliance is configured as a VPN Gateway or as an AAA virtual server. These perimeter devices are frequently placed at the network edge to provide remote access, making them attractive targets for attackers seeking stealthy initial access. The attack surface expands further in deployments that use SAML, whether the device operates as a Service Provider or Identity Provider in single sign-on environments.
Citrix originally described the weakness as a memory overflow capable of causing erratic behavior and service denial. Subsequent public technical analysis revealed an exploitation chain that enables pre-authentication remote code execution with full root privileges, a significantly more severe outcome than simple denial of service.
Observed attack campaigns follow a spray-and-pray pattern, with attackers deploying webshells after successful compromise and issuing basic reconnaissance commands to map the environment. The potential reach is substantial: tens of thousands of NetScaler devices are exposed to the internet, including a meaningful number of publicly visible Gateway instances that typically trigger mass scanning once a reliable exploitation path emerges.
Defensive action requires immediate updating to corrected builds released by Citrix, such as version 14.1-72.61, 13.1-63.18, and for FIPS or NDcPP environments, 13.1-37.272 or later. Organizations should also conduct a full inventory of exposed instances, verify actual running versions and configurations, and hunt for indicators of compromise including webshells and reconnaissance artifacts. Where devices remain exposed as VPN Gateway or AAA servers, emergency patching windows and additional hardening measures such as network segmentation and restricted administrative access are strongly recommended.
