Loading vulnerability…
CVE-2026-8452 is a high-severity memory-overflow vulnerability in Citrix NetScaler ADC and NetScaler Gateway. The flaw occurs in the nsppe packet-processing engine while parsing SAML XML signature data: attacker-controlled InclusiveNamespaces PrefixList content is copied into a fixed-size buffer during XML signature canonicalization without adequate bounds validation. The vulnerable processing occurs before SAML signature verification. Citrix characterized the issue as capable of causing unpredictable behavior or denial of service; independent research demonstrated that the heap overflow can potentially be developed into unauthenticated remote code execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
This repository contains a single Python exploit script and a README. The script `watchTowr-vs-Citrix-Netscaler-PreAuth-RCE.py` is a standalone pre-auth remote code execution exploit for Citrix NetScaler, targeting CVE-2026-8452 via a SAML PrefixList heap overflow in the AAA service. It is not merely a detector despite the README wording; the code actively exploits the target and drops a webshell. Repository structure is minimal: `README.md` documents affected versions, example usage, and states that offsets are hardcoded for NetScaler 13.1-30.52; the Python script contains the full exploit logic. The script uses `pwntools` for shellcode generation/assembly, `capstone` for instruction splitting, and `requests` with a custom `LegacyAdapter` to support legacy TLS connections and disable certificate validation. Exploit flow: `main()` parses `--target`, creates an HTTPS session, builds FreeBSD/amd64 shellcode in `build_sc()`, then initializes the SAML flow against the target to obtain a request ID and Assertion Consumer Service URL. The shellcode writes a PHP webshell to `/var/vpn/theme/x.php` with body `<?php echo(system($_GET[0])); ?>`, closes the file, and performs additional system calls including chmod on `/bin/sh`. Helper routines such as `split_insns()`, `lay_sc()`, and `make_prefixlist()` prepare a malicious PrefixList payload while avoiding blocked bytes and embedding hardcoded memory addresses (`POOL_A3`, `SC_ENTRY`, `MEMCPY_DST`, `MEMMOVE_DST`) suitable for the specified target version. The exploit then crafts a malicious SAML response and submits it as a `SAMLResponse` form field to the target ACS endpoint. After delivery, it polls `https://<target>/vpn/theme/x.php?0=uname+-a;id` to confirm successful code execution and display command output. Overall capability is unauthenticated RCE with persistent webshell deployment on vulnerable NetScaler appliances.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
174 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
One component of the CitrixBleed Infinity Citrix NetScaler memory-disclosure and heap-overflow exploit chain.
Citrix NetScaler ADC 및 NetScaler Gateway에서 메모리 버퍼 범위 내 작업 제한이 부적절하게 이루어지는 취약점.
An improper restriction of operations within the bounds of a memory buffer vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. It is listed in the CISA KEV catalog.
A critical CWE-119 memory-buffer-bounds flaw in Citrix NetScaler ADC and NetScaler Gateway that permits unauthenticated denial of service. CISA added it to the Known Exploited Vulnerabilities catalog on August 26, 2026, after confirming exploitation in attacks; disruption of edge-deployed appliances can affect application access, VPN/remote services, authentication portals, and routed network resources.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.