✅ Report Title: NetScaler Vulnerability Analysis: CVE-2026-8452

✅ Executive Summary

📌 Vulnerability Overview

• On August 26, 2026, recent in-the-wild exploitation of CVE-2026-8452, a Remote Code Execution vulnerability in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway), was confirmed.
• The vulnerability was found to affect the following product versions.
  • NetScaler ADC and NetScaler Gateway 14.1 < 14.1-72.61
  • NetScaler ADC and NetScaler Gateway 13.1 < 13.1-63.18
  • NetScaler ADC 14.1 FIPS < 14.1-72.61 FIPS
  • NetScaler ADC 13.1 FIPS and NDcPP < 13.1-37.272
• On June 30, 2026, the vulnerability was disclosed with a CVSSv4.0 score of 8.8 (High), and a patch was released.
• On August 17, 2026, exploitation by unidentified threat actors was confirmed, and organizations are advised to respond promptly.

📌 Attack Activity

• On August 17, 2026, NHS England's National CSOC raised its alert level to High based on exploitation attempts against honeypots and reports of real-world exploitation.
• On August 26, 2026, the Canadian Centre for Cyber Security updated its advisory to confirm in-the-wild exploitation of the vulnerability based on publicly available information.
• On August 26, 2026, CISA added CVE-2026-8452 to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation.
• On August 27, 2026, Previdian and Defused disclosed that attackers had deployed x.php and z.php web shells on vulnerable appliances and executed system reconnaissance commands such as id and echo.

📌 What Is the Root Cause of the Vulnerability?

• The vulnerability is a Remote Code Execution flaw in NetScaler ADC and NetScaler Gateway caused by insufficient memory buffer bounds checking during SAML XML signature canonicalization.
• The vulnerable code path is activated when a SAML service provider or identity provider policy is bound to a Gateway or AAA virtual server.
• Before verifying the SAML signature, the nsppe process canonicalizes the ds:SignedInfo element, during which it copies the attacker-controllable PrefixList value of the ec:InclusiveNamespaces element into a fixed-size buffer without sufficient length validation.
• An overly long PrefixList value overflows beyond the data region of the current nsb network buffer, corrupting the data pointer and memory management information of the adjacent nsb chunk.
• The corrupted pointer is subsequently used in a way that allows an attacker to control both the source and destination addresses of a memory write, which can result in an arbitrary memory write and, through function pointer tampering, control of execution flow.
• Because the nsppe process runs with root privileges, this control of execution flow can ultimately lead to code execution with root privileges.

✅ Threat Detection Recommendations and Mitigation Measures:

• Apply the security update provided by the vendor.
  • NetScaler ADC and NetScaler Gateway 14.1 ≥ 14.1-72.61
  • NetScaler ADC and NetScaler Gateway 13.1 ≥ 13.1-63.18
  • NetScaler ADC 14.1 FIPS ≥ 14.1-72.61 FIPS
  • NetScaler ADC 13.1 FIPS and NDcPP ≥ 13.1-37.272
• These versions are the minimum builds in which CVE-2026-8452 was first fixed; in production environments, apply the latest maintenance build at or above these versions provided by the vendor.
• Upgrade end-of-support NetScaler 12.1 and 13.0 series to a supported version, and in HA configurations, apply the security update to all nodes and verify the applied version using the show ns version command.
• If immediate patching is not possible, it is recommended to apply the mitigation measures below.
  • Identify SAML authentication policies bound to externally exposed Gateway or AAA virtual servers, and where operationally feasible, unbind those policies or disable SAML authentication until the patch is applied.
  • Restrict access to Gateway and AAA virtual servers to trusted IP ranges via firewalls and access control devices, and block unnecessary internet access.
  • For internet-facing appliances where the above mitigations cannot be applied, consider temporarily suspending the affected virtual server or service until the security update is complete.