{"schema":"vulnpedia.research/1","cve":"CVE-2026-8452","references":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604","tags":["Vendor Advisory"],"source":"mitre","sourceId":"NetScaler","modified":"2026-06-30T12:57:25.158Z","origins":[{"source":"mitre","sourceId":"NetScaler","modified":"2026-06-30T12:57:25.158Z","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604"},{"source":"nvd","sourceId":"CVE-2026-8452","modified":"2026-08-27T04:18:00.787","url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8452","tags":["government-resource","US Government Resource"],"source":"mitre","sourceId":"CISA-ADP","modified":"2026-08-27T03:56:34.886Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-08-27T03:56:34.886Z","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8452"},{"source":"nvd","sourceId":"CVE-2026-8452","modified":"2026-08-27T04:18:00.787","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8452"}]},{"source":"euvd","sourceId":"EUVD-2026-40307","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40307","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-40307","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40307"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2026-8452","modified":"2026-08-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-8452","modified":"2026-08-17T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://previdian.com/CVE-2026-8452","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-8452","modified":"2026-08-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-8452","modified":"2026-08-17T00:00:00Z","url":"https://previdian.com/CVE-2026-8452"}]},{"url":"https://www.linkedin.com/posts/this-morning-we-started-seeing-exploitation-share-7495030099205988353-6TYd/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-8452","modified":"2026-08-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-8452","modified":"2026-08-17T00:00:00Z","url":"https://www.linkedin.com/posts/this-morning-we-started-seeing-exploitation-share-7495030099205988353-6TYd/"}]},{"url":"https://x.com/DefusedCyber/status/2089304576759415270","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-8452","modified":"2026-08-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-8452","modified":"2026-08-17T00:00:00Z","url":"https://x.com/DefusedCyber/status/2089304576759415270"}]},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-8452","modified":"2026-08-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-8452","modified":"2026-08-17T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-8452","modified":"2026-08-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-8452","modified":"2026-08-17T00:00:00Z","url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape"}]},{"url":"https://vulncheck.com/xdb/c9e400c6fcd1","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"c9e400c6fcd1","modified":"2026-08-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"c9e400c6fcd1","modified":"2026-08-17T00:00:00Z","url":"https://vulncheck.com/xdb/c9e400c6fcd1"}]},{"url":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"c9e400c6fcd1","modified":"2026-08-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"c9e400c6fcd1","modified":"2026-08-17T00:00:00Z","url":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/securekomodo/citrixInspector","source":"poc-in-github","sourceId":"CVE-2026-8452","description":"Passively fingerprint Citrix ADC / NetScaler ADC & Gateway builds and detect known CVEs — CVE-2023-3519, CitrixBleed 2/3, CVE-2026-8452, and CVE-2026-88771/88772 (KEV)","modified":"2026-10-03T10:32:00Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-8452","url":"https://github.com/securekomodo/citrixInspector"},{"source":"poc-in-github","sourceId":"CVE-2026-8452","modified":"2026-10-03T10:32:00Z","url":"https://github.com/securekomodo/citrixInspector"}],"tags":[]},{"url":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452","source":"poc-in-github","sourceId":"CVE-2026-8452","description":"CVE-2026-8452 PreAuth RCE","modified":"2026-09-28T05:23:44Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-8452","url":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452"},{"source":"poc-in-github","sourceId":"CVE-2026-8452","modified":"2026-09-28T05:23:44Z","url":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452"}],"tags":[]},{"url":"https://github.com/BishopFox/CVE-2026-8452-check","source":"poc-in-github","sourceId":"CVE-2026-8452","description":"Safely detect Citrix NetScaler CVE-2026-8452","modified":"2026-08-22T09:10:10Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-8452","url":"https://github.com/BishopFox/CVE-2026-8452-check"},{"source":"poc-in-github","sourceId":"CVE-2026-8452","modified":"2026-08-22T09:10:10Z","url":"https://github.com/BishopFox/CVE-2026-8452-check"}],"tags":[]},{"url":"https://github.com/maxprog-svg/CitrixBleedCVE-2026-8452-2025-5777","source":"poc-in-github","sourceId":"CVE-2026-8452","description":"CitrixBleed Exploit Tool - CVE-2025-5777 & CVE-2026-8452. Unauthenticated remote memory read from Citrix NetScaler ADC & Gateway. Steal admin session tokens, extract nsroot hashes, dump secrets, and bypass MFA. Python 3 exploit with full memory parsing.","modified":"2026-08-30T13:23:18Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-8452","url":"https://github.com/maxprog-svg/CitrixBleedCVE-2026-8452-2025-5777"},{"source":"poc-in-github","sourceId":"CVE-2026-8452","modified":"2026-08-30T13:23:18Z","url":"https://github.com/maxprog-svg/CitrixBleedCVE-2026-8452-2025-5777"}],"tags":[]},{"url":"https://github.com/techupdate24/citrix-netscaler-cve-2026-8452-rce","source":"poc-in-github","sourceId":"CVE-2026-8452","description":"A complete guide and workflow for integrating Agile sprints with DevOps CI/CD pipelines.","modified":"2026-09-27T07:29:57Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-8452","url":"https://github.com/techupdate24/citrix-netscaler-cve-2026-8452-rce"},{"source":"poc-in-github","sourceId":"CVE-2026-8452","modified":"2026-09-27T07:29:57Z","url":"https://github.com/techupdate24/citrix-netscaler-cve-2026-8452-rce"}],"tags":[]}],"cataloguedPoc":[{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"c9e400c6fcd1","url":"https://vulncheck.com/xdb/c9e400c6fcd1","cve":"CVE-2026-8452","dateAdded":"2026-08-14T19:55:35Z","modified":"2026-08-17T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452","observations":[{"dateAdded":"2026-08-14T19:55:35Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"c9e400c6fcd1","modified":"2026-08-17T00:00:00Z","url":"https://vulncheck.com/xdb/c9e400c6fcd1"}]}],"vendorStatements":[],"exploitationSources":[{"source":"vulncheck-kev","sourceId":"CVE-2026-8452","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-08-17T00:00:00Z","modified":"2026-08-17T00:00:00Z","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown","reportedByVulncheckCanaries":false,"vendorProject":"Citrix","product":"NetScaler ADC and NetScaler Gateway","dueDate":"2026-08-29T00:00:00Z","cisaDateAdded":"2026-08-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-8452","modified":"2026-08-17T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-8452","catalog":"VulnCheck KEV","kind":"report","url":"https://previdian.com/CVE-2026-8452","dateAdded":"2026-08-17T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-8452","url":"https://previdian.com/CVE-2026-8452"},{"source":"vulncheck-kev","sourceId":"CVE-2026-8452","url":"https://www.linkedin.com/posts/this-morning-we-started-seeing-exploitation-share-7495030099205988353-6TYd/"},{"source":"vulncheck-kev","sourceId":"CVE-2026-8452","url":"https://x.com/DefusedCyber/status/2089304576759415270"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-8452","catalog":"VulnCheck KEV","kind":"report","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","dateAdded":"2026-08-26T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-8452","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-8452","catalog":"VulnCheck KEV","kind":"report","url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape","dateAdded":"2026-09-08T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-8452","url":"https://www.recordedfuture.com/blog/august-2026-cve-landscape"}]}]}