Loading vulnerability…
CVE-2026-8452 is a memory-corruption vulnerability in Citrix NetScaler ADC and NetScaler Gateway SAML parsing. The vulnerable code processes attacker-controlled PrefixList data during XML signature canonicalization before signature verification and copies it into a fixed-size buffer without adequate bounds checking, resulting in a heap overflow. The issue affects vulnerable Gateway or AAA virtual servers with SAML configured. Citrix characterized the flaw as capable of causing unpredictable behavior or denial of service, while independent research demonstrated that it may be chained for unauthenticated remote code execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (5 hidden).
This repository contains a single Python exploit script and a README. The script `watchTowr-vs-Citrix-Netscaler-PreAuth-RCE.py` is a standalone pre-auth remote code execution exploit for Citrix NetScaler, targeting CVE-2026-8452 via a SAML PrefixList heap overflow in the AAA service. It is not merely a detector despite the README wording; the code actively exploits the target and drops a webshell. Repository structure is minimal: `README.md` documents affected versions, example usage, and states that offsets are hardcoded for NetScaler 13.1-30.52; the Python script contains the full exploit logic. The script uses `pwntools` for shellcode generation/assembly, `capstone` for instruction splitting, and `requests` with a custom `LegacyAdapter` to support legacy TLS connections and disable certificate validation. Exploit flow: `main()` parses `--target`, creates an HTTPS session, builds FreeBSD/amd64 shellcode in `build_sc()`, then initializes the SAML flow against the target to obtain a request ID and Assertion Consumer Service URL. The shellcode writes a PHP webshell to `/var/vpn/theme/x.php` with body `<?php echo(system($_GET[0])); ?>`, closes the file, and performs additional system calls including chmod on `/bin/sh`. Helper routines such as `split_insns()`, `lay_sc()`, and `make_prefixlist()` prepare a malicious PrefixList payload while avoiding blocked bytes and embedding hardcoded memory addresses (`POOL_A3`, `SC_ENTRY`, `MEMCPY_DST`, `MEMMOVE_DST`) suitable for the specified target version. The exploit then crafts a malicious SAML response and submits it as a `SAMLResponse` form field to the target ACS endpoint. After delivery, it polls `https://<target>/vpn/theme/x.php?0=uname+-a;id` to confirm successful code execution and display command output. Overall capability is unauthenticated RCE with persistent webshell deployment on vulnerable NetScaler appliances.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
185 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An exploited Citrix vulnerability mentioned only as background context from separate recent coverage.
A Citrix NetScaler vulnerability mentioned only as another recently added entry in CISA's Known Exploited Vulnerabilities catalog; no technical details are provided.
Citrix NetScaler ADC and NetScaler Gateway buffer-overflow vulnerability listed as historical NetScaler exploitation context.
A separate unauthenticated remote-code-execution vulnerability in Citrix NetScaler, described as a SAML heap overflow that enables direct in-memory shellcode execution.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.