CVE-2026-8451: Memory Overread in Citrix NetScaler ADC/Gateway SAML IdP ('CitrixBleed'-class, CVSS 8.8) — Exploited Within 24 Hours of Disclosure

CVE-2026-8451 (TL-2026-1092), also tracked as CitrixBleed-style NetScaler SAML Overread, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-07-02. It has no confirmed attribution, affects Citrix NetScaler ADC, references 7 CVEs (CVE-2026-8451, CVE-2026-3055, CVE-2026-8452), maps to 13 MITRE ATT&CK techniques (T1005, T1027, T1046), and is covered by 9 detection rules and 16 indicators of compromise.

Key facts for TL-2026-1092

Threat ID
TL-2026-1092
Also known as
CitrixBleed-style NetScaler SAML Overread, NetScaler SAML IdP Memory Overread
Severity
HIGH
CVSS
8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Status
PATCHED
Category
VULNERABILITY
First published
2026-07-02
Last reviewed
2026-07-02
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, finance, health, technology, education, critical-infrastructure
Target regions
Global
Detection rules
9
Indicators of compromise
16

Malware and tooling in CVE-2026-8451

Malware and tooling: python-requests/2.32.5, watchTowr-vs-Netscaler-CVE-2026-8451 (GitHub 'Detection Artifact Generator')

An unauthenticated, pre-auth memory overread vulnerability in Citrix NetScaler ADC/Gateway's custom XML parser for SAML AuthnRequest processing at /saml/login lets attackers leak adjacent process memory — including pointer values — into the NSC_TASS authentication cookie when the appliance is configured as a SAML Identity Provider. Discovered by watchTowr Labs in March 2026 while reproducing the related CVE-2026-3055, patched by Citrix on 2026-06-30 (CTX696604), and confirmed exploited in the wild within roughly 24 hours of disclosure by decoy-infrastructure operator Lupovis, which traced a validation-then-exploit pattern to IP 146.70.139.154.

How CVE-2026-8451 works

CVE-2026-8451 is the latest entry in the 'CitrixBleed' family of memory-disclosure vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway appliances configured as SAML Identity Providers. The root cause is a parser-boundary defect in NetScaler's custom XML attribute tokenizer used when processing SAML AuthnRequest messages submitted to the /saml/login endpoint. The parser correctly terminates quoted attribute values on a matching quote character, but for unquoted attribute values it terminates only on a space, `>`, or null byte — critically, it fails to treat a newline (` `) as a terminator. An attacker who submits a malformed, base64-encoded SAMLRequest containing an unquoted, unterminated attribute (for example `AssertionConsumerServiceURL=` or `ID=` with no following terminator before the end of the request buffer) forces the parser to continue scanning past the intended attribute boundary and into adjacent heap/stack memory. The over-read bytes — which have included canary values, pointer-like data (e.g. 0xa10ca7ed-style patterns), and adjacent XML-parser state — are base64-encoded and returned to the client embedded in the NSC_TASS authentication cookie, giving an unauthenticated remote attacker a reliable memory-disclosure primitive against internet-facing NetScaler SAML IdP endpoints.

watchTowr Labs discovered the flaw in late March 2026 while independently reproducing CVE-2026-3055, a prior CitrixBleed-class SAML IdP memory overread that CISA added to the KEV catalog on 2026-03-30. watchTowr notified Citrix at discovery, escalated on 2026-05-07 after an extended silence, and Citrix ultimately shipped fixed builds (14.1-72.61 and 13.1-63.18, plus corresponding FIPS/NDcPP builds) on 2026-06-30 under advisory CTX696604, alongside five other NetScaler CVEs disclosed in the same batch (CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, CVE-2026-13474) covering DoS and unauthenticated file-read issues. watchTowr published a detailed technical write-up and a 'Detection Artifact Generator' PoC on GitHub the same day.

Within roughly 24 hours of public disclosure, decoy-infrastructure operator Lupovis observed real-world exploitation: a threat actor operating from 146.70.139.154 (M247 Europe SRL, AS9009, Frankfurt, Germany) probed three separate Lupovis honeypot sensors over a five-hour window (30 June–1 July 2026). The actor's python-requests/2.32.5-based tooling issued validation probes against Sensor A (two 404s) and Sensor B (404) before Sensor C returned a 200, at which point the actor immediately delivered the full CVE-2026-8451 SAML exploitation payload — a pattern consistent with automated, opportunistic mass-scanning rather than targeted intrusion. As of this writing CVE-2026-8451 itself has not yet been added to the CISA KEV catalog, though its sibling CVE-2026-3055 already is, and given the rapid weaponization and shared root cause defenders should treat KEV addition as imminent.

Because the leaked memory can include session-related pointer data and appears inside an authentication cookie, successful exploitation gives an attacker a foothold for further session-hijacking or reconnaissance against the appliance without any authentication, making unpatched, internet-facing NetScaler SAML IdP deployments high-priority remediation targets.

MITRE ATT&CK techniques used in TL-2026-1092

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery

Command and Control

T1071 Application Layer Protocol

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1499 Endpoint Denial of Service

Credential Access

T1539 Steal Web Session Cookie

Resource Development

T1583 Acquire Infrastructure; T1588 Obtain Capabilities

Reconnaissance

T1590 Gather Victim Network Information; T1592 Gather Victim Host Information; T1595 Active Scanning

Affected products and versions in CVE-2026-8451

  • Citrix — NetScaler ADC
    Vulnerable versions: 14.1 before 14.1-72.61; 13.1 before 13.1-63.18; 14.1 FIPS before 14.1-72.61 FIPS; 13.1 FIPS/NDcPP before 13.1-37.272 FIPS/NDcPP
    Fixed in: 14.1-72.61; 13.1-63.18; 14.1-72.61 FIPS; 13.1-37.272 FIPS/NDcPP
  • Citrix — NetScaler Gateway
    Vulnerable versions: 14.1 before 14.1-72.61; 13.1 before 13.1-63.18
    Fixed in: 14.1-72.61; 13.1-63.18

Remediation for CVE-2026-8451

Patches

  • Upgrade to NetScaler ADC/Gateway 14.1-72.61 or later
  • Upgrade to NetScaler ADC/Gateway 13.1-63.18 or later
  • Upgrade NetScaler ADC FIPS to 14.1-72.61 FIPS or later
  • Upgrade NetScaler ADC FIPS/NDcPP to 13.1-37.272 FIPS/NDcPP or later

Immediate actions

  • Restrict network access to /saml/login and all SAML IdP endpoints on affected NetScaler appliances to trusted networks only
  • Monitor NetScaler nsppe process logs and SAML AuthnReq parser logs for malformed/unterminated XML attribute patterns
  • Rotate NSC_TASS session cookie signing/encryption material if compromise is suspected
  • Block or heavily scrutinize traffic from 146.70.139.154 and other M247 Europe SRL (AS9009) address space targeting SAML endpoints

Workarounds

  • Disable SAML IdP configuration on the appliance if not in active use
  • Restrict SAML IdP endpoint exposure to internal networks or trusted IP ranges via network ACLs

Longer-term hardening

  • Deploy WAF/IPS signatures for malformed unquoted SAML XML attributes lacking proper terminators
  • Establish a rapid patch-validation pipeline for NetScaler given the recurring CitrixBleed-class defect pattern
  • Consider disabling SAML IdP functionality on NetScaler appliances that do not require it to reduce attack surface

CVEs associated with CVE-2026-8451

CVE-2026-8451, CVE-2026-3055, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, CVE-2026-13474

Weaknesses (CWE) in CVE-2026-8451

CWE-125, CWE-20

Timeline of CVE-2026-8451

  • watchTowr Labs discovers CVE-2026-8451 while independently reproducing the earlier CitrixBleed-class flaw CVE-2026-3055, and notifies Citrix.
  • CISA adds the related sibling vulnerability CVE-2026-3055 (same SAML IdP memory-overread root-cause family) to the Known Exploited Vulnerabilities catalog.
  • watchTowr escalates its report to Citrix after an extended period without a fix, pressing for patch status.
  • watchTowr Labs publishes a full technical write-up and a public 'Detection Artifact Generator' PoC on GitHub detailing the XML parser boundary defect and exploitation steps.
  • Citrix publishes security bulletin CTX696604 and ships fixed builds (14.1-72.61, 13.1-63.18, and corresponding FIPS/NDcPP builds) addressing CVE-2026-8451 alongside five other NetScaler CVEs.
  • Decoy-infrastructure operator Lupovis detects the first real-world exploitation attempt: a threat actor from 146.70.139.154 (M247 Europe SRL, AS9009, Frankfurt) probes three honeypot sensors over a five-hour window and delivers a full CVE-2026-8451 SAML exploitation payload upon finding a responsive target — within roughly 24 hours of public disclosure.
  • SOCRadar, The Hacker News, eSecurity Planet, IONIX, Tenable, and Penligent publish coverage and technical summaries of CVE-2026-8451.
  • CyberScoop, LatestHackingNews, and cybersecuritynews.com report on the confirmed active exploitation, citing Lupovis' sensor telemetry.

Sources cited for CVE-2026-8451

Threats related to CVE-2026-8451

Detection coverage for TL-2026-1092

As of 2026-07-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1092 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats