# CVE-2026-8451: Memory Overread in Citrix NetScaler ADC/Gateway SAML IdP ('CitrixBleed'-class, CVSS 8.8) — Exploited Within 24 Hours of Disclosure

> An unauthenticated, pre-auth memory overread vulnerability in Citrix NetScaler ADC/Gateway's custom XML parser for SAML AuthnRequest processing at /saml/login lets attackers leak adjacent process memory — including pointer values — into the NSC_TASS authentication cookie when the appliance is configured as a SAML Identity Provider. Discovered by watchTowr Labs in March 2026 while reproducing the related CVE-2026-3055, patched by Citrix on 2026-06-30 (CTX696604), and confirmed exploited in the wild within roughly 24 hours of disclosure by decoy-infrastructure operator Lupovis, which traced a validation-then-exploit pattern to IP 146.70.139.154.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1092
- **ID:** TL-2026-1092
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-8451, CVE-2026-3055, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, CVE-2026-13474

## Description

CVE-2026-8451 is the latest entry in the 'CitrixBleed' family of memory-disclosure vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway appliances configured as SAML Identity Providers. The root cause is a parser-boundary defect in NetScaler's custom XML attribute tokenizer used when processing SAML AuthnRequest messages submitted to the /saml/login endpoint. The parser correctly terminates quoted attribute values on a matching quote character, but for unquoted attribute values it terminates only on a space, `>`, or null byte — critically, it fails to treat a newline (`\n`) as a terminator. An attacker who submits a malformed, base64-encoded SAMLRequest containing an unquoted, unterminated attribute (for example `AssertionConsumerServiceURL=` or `ID=` with no following terminator before the end of the request buffer) forces the parser to continue scanning past the intended attribute boundary and into adjacent heap/stack memory. The over-read bytes — which have included canary values, pointer-like data (e.g. 0xa10ca7ed-style patterns), and adjacent XML-parser state — are base64-encoded and returned to the client embedded in the NSC_TASS authentication cookie, giving an unauthenticated remote attacker a reliable memory-disclosure primitive against internet-facing NetScaler SAML IdP endpoints.

watchTowr Labs discovered the flaw in late March 2026 while independently reproducing CVE-2026-3055, a prior CitrixBleed-class SAML IdP memory overread that CISA added to the KEV catalog on 2026-03-30. watchTowr notified Citrix at discovery, escalated on 2026-05-07 after an extended silence, and Citrix ultimately shipped fixed builds (14.1-72.61 and 13.1-63.18, plus corresponding FIPS/NDcPP builds) on 2026-06-30 under advisory CTX696604, alongside five other NetScaler CVEs disclosed in the same batch (CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, CVE-2026-13474) covering DoS and unauthenticated file-read issues. watchTowr published a detailed technical write-up and a 'Detection Artifact Generator' PoC on GitHub the same day.

Within roughly 24 hours of public disclosure, decoy-infrastructure operator Lupovis observed real-world exploitation: a threat actor operating from 146.70.139.154 (M247 Europe SRL, AS9009, Frankfurt, Germany) probed three separate Lupovis honeypot sensors over a five-hour window (30 June–1 July 2026). The actor's python-requests/2.32.5-based tooling issued validation probes against Sensor A (two 404s) and Sensor B (404) before Sensor C returned a 200, at which point the actor immediately delivered the full CVE-2026-8451 SAML exploitation payload — a pattern consistent with automated, opportunistic mass-scanning rather than targeted intrusion. As of this writing CVE-2026-8451 itself has not yet been added to the CISA KEV catalog, though its sibling CVE-2026-3055 already is, and given the rapid weaponization and shared root cause defenders should treat KEV addition as imminent.

Because the leaked memory can include session-related pointer data and appears inside an authentication cookie, successful exploitation gives an attacker a foothold for further session-hijacking or reconnaissance against the appliance without any authentication, making unpatched, internet-facing NetScaler SAML IdP deployments high-priority remediation targets.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1590 Gather Victim Network Information
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1027 Obfuscated Files or Information
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1499 Endpoint Denial of Service

## Sources

- [CVE-2026-8451 Adds a New NetScaler Memory Overread to the CitrixBleed Pattern](https://socradar.io/blog/cve-2026-8451-netscaler-overread-citrixbleed/)
- [CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451)](https://labs.watchtowr.com/citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451/)
- [Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service](https://thehackernews.com/2026/07/citrix-patches-six-netscaler-flaws.html)
- [CVE-2026-8451: Citrix NetScaler Vulnerability Leaks Memory](https://www.esecurityplanet.com/threats/cve-2026-8451-citrix-netscaler-vulnerability-leaks-memory/)
- [CVE-2026-8451 – Memory Overread / Sensitive Data Exposure – NetScaler ADC and NetScaler Gateway](https://www.ionix.io/threat-center/cve-2026-8451/)
- [Citrix patches a new NetScaler flaw with echoes of CitrixBleed](https://cyberscoop.com/citrix-netscaler-flaw-cve-2026-8451-citrixbleed/)
- [CitrixBleed Vulnerability Exploited by Hackers Within 24 Hours of Public Disclosure](https://cybersecuritynews.com/citrixbleed-vulnerability-exploited/)
- [CVE-2026-8451](https://www.tenable.com/cve/CVE-2026-8451)
- [CVE-2026-8451, the NetScaler SAML IdP Memory Overread](https://www.penligent.ai/hackinglabs/cve-2026-8451/)
- [NetScaler Memory Overread Flaw Revives CitrixBleed Fears](https://latesthackingnews.com/2026/07/02/netscaler-memory-overread-citrixbleed/amp/)
- [Citrix Security Bulletin CTX696604](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2026-3055 entry, sibling vulnerability)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog-print)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1092