CVE-2026-8452: Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: yes — in CISA KEV since 2026-08-26
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-30 · updated 2026-08-27
Weakness: CWE-119

Description

Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server

Summary

CVE-2026-8452 is a critical (CVSS 9.8) memory buffer overflow in Citrix NetScaler ADC and NetScaler Gateway that can cause unpredictable behavior and denial of service when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. It affects NetScaler ADC (fixed in 13.1-37.272, 13.1-63.18, 14.1-72.61) and NetScaler Gateway (fixed in 13.1-63.18, 14.1-72.61). CISA lists it as actively exploited in the Known Exploited Vulnerabilities catalog, so treat internet-facing appliances as urgent. Apply the fixed versions or vendor mitigations per CISA BOD 26-04, and discontinue use if mitigations are unavailable.

تُعد CVE-2026-8452 ثغرة تجاوز سعة المخزن المؤقت للذاكرة خطيرة (CVSS 9.8) في Citrix NetScaler ADC وNetScaler Gateway، وقد تؤدي إلى سلوك غير متوقع وتعطّل الخدمة (Denial of Service) عندما يكون الجهاز مُهيأً كـ Gateway (SSL VPN أو ICA Proxy أو CVPN أو RDP Proxy) أو كخادم AAA virtual server. تشمل المنتجات المتأثرة NetScaler ADC (تم إصلاحها في 13.1-37.272 و13.1-63.18 و14.1-72.61) وNetScaler Gateway (تم إصلاحها في 13.1-63.18 و14.1-72.61). تُدرجها CISA في كتالوج الثغرات المعروفة بأنها مُستغلة فعلياً، لذا يجب التعامل مع الأجهزة المكشوفة على الإنترنت كأولوية عاجلة. طبّق الإصدارات المُصلحة أو تخفيفات المخاطر وفق توجيه CISA BOD 26-04، وأوقف استخدام المنتج إذا لم تتوفر التخفيفات.

Affected products

Citrix NetScaler ADC: from 13.1 before 13.1-63.18; from 14.1 before 14.1-72.61 — fixed in 13.1-63.18, 14.1-72.61
Citrix Netscaler Application Delivery Controller Fips: before 13.1-37.272; 14.1-66.68 (and their updates) — fixed in 13.1-37.272
Citrix Netscaler Application Delivery Controller Ndcpp: before 13.1-37.272 — fixed in 13.1-37.272
Citrix NetScaler Gateway: from 13.1 before 13.1-63.18; from 14.1 before 14.1-72.61 — fixed in 13.1-63.18, 14.1-72.61
NetScaler ADC: from 14.1 before 72.61; from 13.1 before 63.18; from 14.1 FIPS before 72.61; from 13.1 FIPS and NDcPP before 37.272 — fixed in 72.61, 63.18, 37.272
NetScaler Gateway: from 14.1 before 72.61; from 13.1 before 63.18 — fixed in 72.61, 63.18

How to fix

Upgrade to a fixed version: Citrix NetScaler ADC 13.1-63.18, 14.1-72.61; Citrix Netscaler Application Delivery Controller Fips 13.1-37.272; Citrix Netscaler Application Delivery Controller Ndcpp 13.1-37.272; Citrix NetScaler Gateway 13.1-63.18, 14.1-72.61; NetScaler ADC 72.61, 63.18, 37.272; NetScaler Gateway 72.61, 63.18. Check the vendor advisory for mitigations.

In the news

You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))

References

Get alerted when CVE-2026-8452 or the next vulnerability affects your stack