CISA has added CVE-2026-8452 to its Known Exploited Vulnerabilities catalog, forcing US federal agencies to patch Citrix NetScaler before the strict deadline of August 29 2026.
The vulnerability affects NetScaler ADC and NetScaler Gateway when the appliance operates as a VPN Gateway or AAA virtual server. These perimeter devices provide remote access to corporate networks, making them high-value targets for attackers seeking initial entry points.
Originally described by Citrix as a memory overflow capable of causing erratic behavior and denial of service, the issue was later shown through public technical analysis to support unauthenticated remote code execution with root privileges on unpatched systems.
The attack surface expands significantly in environments using SAML, whether the device functions as a Service Provider or Identity Provider, particularly in single sign-on deployments.
Observed campaigns follow a spray-and-pray pattern, with attackers deploying webshells after successful compromise and executing basic reconnaissance commands to map the environment.
With tens of thousands of NetScaler devices exposed to the internet, many configured as public Gateway instances, the flaw is expected to trigger widespread automated scanning and exploitation attempts.
Citrix has released corrected builds that close the vulnerability, including version 14.1-72.61, 13.1-63.18, and 13.1-37.272 or higher for FIPS and NDcPP configurations.
Defensive recommendations include immediate inventory of exposed instances, verification of actual software versions and configurations, active hunting for webshells and reconnaissance indicators, and implementation of network segmentation and administrative access restrictions where patching cannot be completed instantly.
