CVE-2026-8452 in Citrix NetScaler: how a SAML parsing overflow became pre-auth code execution

From denial of service to remote code execution

Citrix published fixes for CVE-2026-8452 in August 2026 and initially described the impact as denial of service. The affected builds were NetScaler ADC and NetScaler Gateway 14.1 before 14.1-72.61 and 13.1 before 13.1-63.18, including the FIPS and NDcPP variants. An unauthenticated remote attacker could send crafted SAML input and cause the appliance to behave unpredictably and stop processing traffic.

Further analysis changed the severity picture. Researchers found the overflow was reachable in a way that allowed a write primitive to be constructed, and that the outcome was remote code execution before authentication rather than a crash. The CVSS score is 8.8, classified as a memory buffer bounds weakness. CISA added the flaw to the Known Exploited Vulnerabilities catalog in the 26 August 2026 batch, with remediation due by 29 August for federal civilian agencies.

Reported field activity was specific. Investigators observed web shell files named x.php and z.php on compromised appliances. Public measurement data cited approximately 22,000 NetScaler instances reachable from the internet, and the attack pattern resembled earlier campaigns against the same product line, including CVE-2023-3519 and CVE-2023-4966. Historical similarity does not prove a single actor; it does show that the exploitation method persists across disclosures.

The component that carries the flaw

The overflow sits in nsppe, the packet processing engine. That process handles inbound traffic, including SAML authentication exchange, and it runs with high privilege. That combination explains why a memory corruption issue that begins as a crash can end as root.

The trigger requires a SAML configuration to exist on the appliance. The relevant inspection commands are show saml idp and show saml sp. A configuration does not have to be actively used for business: a stale single sign-on profile left in place after a migration keeps the parsing path alive. This is the detail that creates false confidence in estates where SAML is believed to be unused.

What to do

• Check the firmware build on each appliance against 14.1-72.61 and 13.1-63.18, including FIPS and NDcPP deployments, which carry separate build numbers.
• Run show saml idp and show saml sp and list appliances with any SAML configuration, whether or not it is in service.
• Inspect the web directories used by the management and VPN interfaces for recently created script files, including /var/netscaler/logon/, /netscaler/ns_gui/ and /var/vpn/.
• Rotate certificates and any LDAP, RADIUS or SAML signing secrets the appliance can read, because a host with root on the appliance can read all of them.
• Patching does not remove an established web shell. Search the appliance before and after the upgrade, and rebuild where the shell cannot be fully accounted for.

References

• Citrix security bulletin for CVE-2026-8452
• CISA Known Exploited Vulnerabilities catalog, 26 August 2026 additions
• NVD record for CVE-2026-8452