CVE-2026-8452
HIGH 8.8 KNOWN EXPLOITED PoC CATALOGUED ALL-YEARSMemory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server
Confirmed exploited in the wild — in CISA KEV since 2026-08-26. Patch or mitigate now.
Exploitation likelihood
1.0%chance of exploitation in 30 days · 63rd percentile
Impact if exploited
8.8CVSS 4.0 · HIGH · CNA
- ConfidentialityHigh
- IntegrityLow
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
- ✓Requirements: No special attack requirements
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
Public PoC or exploit resources are catalogued below.
Listed by the named source; Vulnpedia has not tested these resources.
PoC data: JSON
Resource commands
curl -s https://vulnpedia.com/cve/CVE-2026-8452/poc.jsonMachine-readable PoC index for this CVE (for automation).Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Affected
Products Adc Gateway Netscaler Application Delivery Controller Netscaler Gateway
Weakness (CWE)
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L
References and research data (JSON)
Unverified PoC candidates
Catalogue matches for further research. These repositories have not been validated as working exploits.
5 candidates
- https://github.com/securekomodo/citrixInspector
Passively fingerprint Citrix ADC / NetScaler ADC & Gateway builds and detect known CVEs — CVE-2023-3519, CitrixBleed 2/3, CVE-2026-8452, and CVE-2026-88771/88772 (KEV)
PoC-in-GitHub · CVE-2026-8452
PoC-in-GitHub · CVE-2026-8452 · Updated 2026-10-03T10:32:00Z - https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452
CVE-2026-8452 PreAuth RCE
PoC-in-GitHub · CVE-2026-8452
PoC-in-GitHub · CVE-2026-8452 · Updated 2026-09-28T05:23:44Z - https://github.com/BishopFox/CVE-2026-8452-check
Safely detect Citrix NetScaler CVE-2026-8452
PoC-in-GitHub · CVE-2026-8452
PoC-in-GitHub · CVE-2026-8452 · Updated 2026-08-22T09:10:10Z - https://github.com/maxprog-svg/CitrixBleedCVE-2026-8452-2025-5777
CitrixBleed Exploit Tool - CVE-2025-5777 & CVE-2026-8452. Unauthenticated remote memory read from Citrix NetScaler ADC & Gateway. Steal admin session tokens, extract nsroot hashes, dump secrets, and bypass MFA. Python 3 exploit with full memory parsing.
PoC-in-GitHub · CVE-2026-8452
PoC-in-GitHub · CVE-2026-8452 · Updated 2026-08-30T13:23:18Z - https://github.com/techupdate24/citrix-netscaler-cve-2026-8452-rce
A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.
PoC-in-GitHub · CVE-2026-8452
PoC-in-GitHub · CVE-2026-8452 · Updated 2026-09-27T07:29:57Z
Additional exploitation reports
Source-specific reports, separate from CISA KEV. Repeated observations from one source are not independent confirmations.
- VulnCheck KEV · 2026-08-17T00:00:00Z
Source guidance: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source ransomware assessment: Unknown
VulnCheck KEV · CVE-2026-8452 · Updated 2026-08-17T00:00:00Z - VulnCheck KEV · 2026-08-17T00:00:00ZVulnCheck KEV · CVE-2026-8452
VulnCheck KEV · CVE-2026-8452
VulnCheck KEV · CVE-2026-8452 - VulnCheck KEV · 2026-08-26T00:00:00ZVulnCheck KEV · CVE-2026-8452
- VulnCheck KEV · 2026-09-08T00:00:00ZVulnCheck KEV · CVE-2026-8452
Known Affected Software Configurations
| Vendor | Product | Version range |
|---|---|---|
| Citrix | Netscaler Application Delivery Controller | < 13.1-37.272 |
| Citrix | Netscaler Application Delivery Controller | < 13.1-37.272 |
| Citrix | Netscaler Application Delivery Controller | ≥ 13.1 and < 13.1-63.18 |
| Citrix | Netscaler Application Delivery Controller | ≥ 14.1 and < 14.1-72.61 |
| Citrix | Netscaler Application Delivery Controller | 14.1-66.68 |
| Citrix | Netscaler Gateway | ≥ 13.1 and < 13.1-63.18 |
| Citrix | Netscaler Gateway | ≥ 14.1 and < 14.1-72.61 |
All CVSS metrics
- HIGH 8.8 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L - HIGH 8.8 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CRITICAL 9.8 v3.1 · NVD Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Advisories
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604 CVE record · NetScaler · Updated 2026-06-30T12:57:25.158Z
NVD · CVE-2026-8452 · Updated 2026-08-27T04:18:00.787 - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8452 CVE record · CISA-ADP · Updated 2026-08-27T03:56:34.886Z
NVD · CVE-2026-8452 · Updated 2026-08-27T04:18:00.787 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40307 EUVD · EUVD-2026-40307
- https://vulncheck.com/kev VulnCheck KEV · CVE-2026-8452 · Updated 2026-08-17T00:00:00Z
Technical & other
- https://previdian.com/CVE-2026-8452 VulnCheck KEV · CVE-2026-8452 · Updated 2026-08-17T00:00:00Z
- https://www.linkedin.com/posts/this-morning-we-started-seeing-exploitation-share-7495030099205988353-6TYd/ VulnCheck KEV · CVE-2026-8452 · Updated 2026-08-17T00:00:00Z
- https://x.com/DefusedCyber/status/2089304576759415270 VulnCheck KEV · CVE-2026-8452 · Updated 2026-08-17T00:00:00Z
- https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json VulnCheck KEV · CVE-2026-8452 · Updated 2026-08-17T00:00:00Z
- https://www.recordedfuture.com/blog/august-2026-cve-landscape VulnCheck KEV · CVE-2026-8452 · Updated 2026-08-17T00:00:00Z
- https://vulncheck.com/xdb/c9e400c6fcd1 VulnCheck KEV · c9e400c6fcd1 · Updated 2026-08-17T00:00:00Z
- https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452 VulnCheck KEV · c9e400c6fcd1 · Updated 2026-08-17T00:00:00Z
Sources: NVD · CVE.org · All sources and attribution · EPSS