Loading story…
Researchers analyzing CVE-2023-3519, the critical Citrix ADC and NetScaler Gateway vulnerability previously reported as exploited in the wild, identified pre-authentication memory-corruption conditions in SAML/SSO-related request handling. Patch-diff analysis indicated that unpatched SAML parsing lacks a bounds check on CanonicalizationMethod values processed by ns_aaa_saml_parse_authn_request, enabling an out-of-bounds write; testing demonstrated crashes and memory corruption, though the researchers did not achieve arbitrary remote code execution. The affected parsing path appeared reachable when SAML/SSO is enabled, while other pre-authentication paths may also exist.
A separate analysis found that the /gwtest/formssso endpoint can crash when supplied with event=start or event=stop and an oversized URL-encoded target parameter. The patched code restricts the parameter to fewer than 0x80 bytes before decoding, whereas the unpatched code lacks that check; researchers demonstrated instruction-pointer control but not command execution. Organizations should apply Citrix fixes for CVE-2023-3519 and related Citrix ADC/Gateway issues, review CISA compromise indicators, and assess exposed appliances; HTTP 500 responses alone are not a reliable indicator because they can occur on both patched and unpatched systems.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
An exploit for CVE-2023-3519 was reportedly offered for sale online beginning in June 2023.
Researchers reported that an oversized URL-encoded target parameter sent to /gwtest/formssso with event=start or event=stop could crash unpatched Citrix ADC and NetScaler Gateway appliances. They demonstrated instruction-pointer control by redirecting execution to stack-resident INT3 instructions; patched code enforces a decoded-input limit below 0x80 bytes.
Patch-diff analysis identified a suspected out-of-bounds write in Citrix's SAML parser: unpatched code allegedly failed to bound CanonicalizationMethod values stored in a fixed array. Researchers demonstrated crashes and memory corruption, and developed a malformed-SAML error-oracle method to distinguish patched, unpatched, and SAML-disabled systems.
Citrix issued an advisory and patches for CVE-2023-3519, a critical remote-code-execution vulnerability affecting Citrix ADC and NetScaler Gateway that was reportedly exploited in the wild.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
slcyber.io
Open sourceslcyber.io
Open sourcesupport.citrix.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citrix released fixes for six vulnerabilities in **NetScaler ADC** and **NetScaler Gateway**, including **CVE-2026-8451**, a high-severity out-of-bounds read flaw that can leak sensitive memory from appliances configured as a **SAML Identity Provider**. The bug affects customer-managed NetScaler ADC, Gateway, and related **FIPS/NDcPP** variants, and can expose memory contents in the `NSC_TASS` cookie via malformed requests to the `/saml/login` endpoint. Other patched issues include **CVE-2026-8452**, **CVE-2026-8655**, **CVE-2026-10816**, **CVE-2026-10817**, and **CVE-2026-13474**, covering risks such as arbitrary file reads, memory corruption, and denial of service, including a new **HTTP/2 Bomb** attack. Security researchers and defenders reported that **CVE-2026-8451** was exploited in the wild less than 24 hours after public disclosure, with Lupovis observing threat actors scanning exposed NetScaler systems and sending exploit payloads immediately after receiving valid `200 OK` responses. The observed activity matched public technical details released by watchTowr, using malformed SAML `AuthnRequest` data padded to trigger the overread condition. Government and industry advisories urged organizations to patch immediately, disable **SAML IdP** where patching is not possible, review `/saml/login` traffic and `NSC_TASS` cookie values for signs of compromise, restrict management exposure, and follow Citrix incident guidance if exploitation is suspected.
Jul 9, 2026
Attackers have begun attempting to exploit **CVE-2026-19490**, a critical authentication-bypass vulnerability in Citrix NetScaler ADC and NetScaler Gateway. Remote, unauthenticated actors can bypass authentication on susceptible appliances configured as AAA virtual servers or Gateway services when affected firmware versions and SAML Action settings are present; sensor data from Previdian confirms exploitation attempts, though not confirmed successful compromises. Citrix issued fixes on August 19 and urged customers to upgrade affected appliances. Australia’s ACSC and Belgium’s national cybersecurity coordination center have also called for urgent patching, warning that internet-facing edge devices are frequent initial-access targets. Organizations should identify exposed NetScaler instances and vulnerable SAML/VPN configurations, apply the relevant updates, and continue monitoring appliances after remediation. Citrix also disclosed **CVE-2026-19489**, a memory-overflow flaw affecting deployments using SIP ALG with Large Scale NAT groups.
Sep 4, 2026
Citrix released security updates to address multiple vulnerabilities affecting **Citrix XenServer**, **NetScaler ADC**, and **NetScaler Gateway**, warning that the flaws could lead to denial-of-service conditions, memory corruption, disclosure of sensitive information, arbitrary code execution, and unauthorized access. The update was highlighted by EG-FinCIRT, which said organizations should apply the fixes after completing testing. The most prominent issues are **`CVE-2026-8451`** and **`CVE-2026-8452`**, both affecting NetScaler ADC and NetScaler Gateway and each assigned a **CVSS 4.0 score of 8.8**. EG-FinCIRT described `CVE-2026-8451` as an insufficient input validation flaw and `CVE-2026-8452` as a race condition vulnerability, underscoring the risk to internet-facing Citrix infrastructure commonly used for application delivery and remote access.
Jul 14, 2026