Loading story…
Citrix released fixes for six vulnerabilities in NetScaler ADC and NetScaler Gateway, including CVE-2026-8451, a high-severity out-of-bounds read flaw that can leak sensitive memory from appliances configured as a SAML Identity Provider. The bug affects customer-managed NetScaler ADC, Gateway, and related FIPS/NDcPP variants, and can expose memory contents in the NSC_TASS cookie via malformed requests to the /saml/login endpoint. Other patched issues include CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, and CVE-2026-13474, covering risks such as arbitrary file reads, memory corruption, and denial of service, including a new HTTP/2 Bomb attack.
Security researchers and defenders reported that CVE-2026-8451 was exploited in the wild less than 24 hours after public disclosure, with Lupovis observing threat actors scanning exposed NetScaler systems and sending exploit payloads immediately after receiving valid 200 OK responses. The observed activity matched public technical details released by watchTowr, using malformed SAML AuthnRequest data padded to trigger the overread condition. Government and industry advisories urged organizations to patch immediately, disable SAML IdP where patching is not possible, review /saml/login traffic and NSC_TASS cookie values for signs of compromise, restrict management exposure, and follow Citrix incident guidance if exploitation is suspected.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Less than 24 hours after public disclosure, Lupovis observed at least two threat actors probing exposed NetScaler instances and sending exploit payloads to systems that returned valid HTTP 200 responses. The observed payloads matched the watchTowr artefact pattern, indicating immediate in-the-wild exploitation of the CitrixBleed-like flaw.
On July 2, 2026, the Canadian Centre for Cyber Security issued Alert AL26-016 warning about CVE-2026-8451 in customer-managed Citrix NetScaler appliances. The alert urged organizations to patch immediately, follow Citrix compromise guidance if exploitation is suspected, and prioritize hardening and isolation of web-facing applications.
On June 30, 2026, watchTowr published technical details and a detection artefact generator/proof-of-concept for CVE-2026-8451 after reproducing the flaw. The material showed how malformed SAML AuthnRequest input could trigger an out-of-bounds read and leak memory in the NSC_TASS cookie.
On June 30, 2026, Citrix disclosed six vulnerabilities affecting NetScaler ADC, NetScaler Gateway, and related FIPS/NDcPP variants, including CVE-2026-8451, and released security updates for affected supported versions. The issues included memory disclosure, arbitrary file read, memory corruption, and denial-of-service risks, with Citrix-managed cloud services already updated.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
thecyberthrone.in
Open sourcehkcert.org
Open sourcecyber.gc.ca
Open sourcecybersecuritynews.com
Open sourcesecurityweek.com
Open sourcesecurityweek.com
Open sourcethreataft.com
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citrix published a security advisory for **NetScaler ADC** and **NetScaler Gateway**, warning that multiple high-severity vulnerabilities can be exploited remotely in specific deployments and configurations. The advisory, highlighted by the Canadian Centre for Cyber Security, affects the `14.1` and `13.1` release lines as well as certain **NetScaler FIPS** and **NDcPP** editions, and references six CVEs including `CVE-2026-8451`, `CVE-2026-8452`, `CVE-2026-8655`, and `CVE-2026-13474`. Administrators were urged to review Citrix’s bulletin and move affected systems to fixed versions. The disclosed flaws include a malformed HTTP/2 request issue that can trigger denial of service when HTTP/2 is enabled on affected LB, CS, VPN virtual servers or services (`CVE-2026-13474`); multiple memory overflow vulnerabilities tied to Oracle load balancer, DNS proxy, and DNS recursive resolver deployments (`CVE-2026-8655`); a memory overread caused by insufficient input validation when NetScaler is configured as a **SAML Identity Provider** (`CVE-2026-8451`); and a separate memory overflow vulnerability affecting **Gateway** or **AAA** virtual servers, including **SSL VPN**, **ICA Proxy**, **CVPN**, and **RDP Proxy** deployments (`CVE-2026-8452`). Recommended mitigations include applying Citrix security updates, disabling HTTP/2 or vulnerable Gateway features where not required, reviewing exposed virtual server and HTTP profile configurations, and monitoring for anomalous behavior.
Jul 1, 2026
Citrix released security updates to address multiple vulnerabilities affecting **Citrix XenServer**, **NetScaler ADC**, and **NetScaler Gateway**, warning that the flaws could lead to denial-of-service conditions, memory corruption, disclosure of sensitive information, arbitrary code execution, and unauthorized access. The update was highlighted by EG-FinCIRT, which said organizations should apply the fixes after completing testing. The most prominent issues are **`CVE-2026-8451`** and **`CVE-2026-8452`**, both affecting NetScaler ADC and NetScaler Gateway and each assigned a **CVSS 4.0 score of 8.8**. EG-FinCIRT described `CVE-2026-8451` as an insufficient input validation flaw and `CVE-2026-8452` as a race condition vulnerability, underscoring the risk to internet-facing Citrix infrastructure commonly used for application delivery and remote access.
Jul 14, 2026
Citrix disclosed **CVE-2025-5777** in NetScaler ADC and NetScaler Gateway alongside **CVE-2025-5349**, warning that affected appliances could be exposed to remote exploitation. Public tracking by ENISA’s EUVD and subsequent reporting identified `CVE-2025-5777` as **CitrixBleed 2**, linking the issue to session exposure risks on internet-facing NetScaler deployments and raising concern for organizations that rely on the products for remote access. After the advisory, proof-of-concept and scanning tools for `CVE-2025-5777` appeared on GitHub, including repositories explicitly branded as **CitrixBleed 2** scanners. The rapid publication of exploit-related code lowered the barrier for attackers to identify vulnerable devices, increasing urgency for defenders to patch NetScaler systems, review exposed gateways, and monitor for signs of session theft or unauthorized access.
Jul 3, 2026