Threat reportVulnerabilityTL-2026-1140

CitrixBleed 2.0: CVE-2026-8451 NetScaler SAML IDP Memory Overread Under Active Exploitation

criticalACTIVE

CitrixBleed 2.0 (TL-2026-1140), also tracked as CitrixBleed 2.0, is a critical-severity software vulnerability scored CVSS 8.8, first published 2026-06-30 and last reviewed 2026-09-09. It has no confirmed attribution, affects Citrix NetScaler ADC, references 3 CVEs (CVE-2026-8451, CVE-2023-4966, CVE-2026-3055), maps to 27 MITRE ATT&CK techniques (T1005, T1020, T1046), and is covered by 9 detection rules and 35 indicators of compromise.

CVSS
8.8/10Critical
CVEs
3Referenced vulnerabilities
Techniques
27MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
35Indicators of compromise

Key facts for TL-2026-1140

Threat ID
TL-2026-1140
Also known as
CitrixBleed 2.0, CitrixBleed 4
Severity
CRITICAL
CVSS
8.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N)
Status
ACTIVE
Category
VULNERABILITY
First published
Last reviewed
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, financial services, health, technology, critical infrastructure, legal services, logistics and supply chain, aerospace and defense
Target regions
North America, Europe, Middle East, Global
Detection rules
9
Indicators of compromise
35
Updates
2026-09-09 · 2 updates · revalidated 2× · latest source

Malware and tooling in CitrixBleed 2.0

Malware and tooling: LockBit 3.0 - S1202, python-requests/2.32.5, watchTowr Detection Artifact Generator (CVE-2026-8451)

How CitrixBleed 2.0 works

Citrix disclosed CVE-2026-8451 on 2026-06-30 (bulletin CTX696604), a pre-authentication out-of-bounds memory read in NetScaler ADC/Gateway's custom SAML AuthnRequest XML parser when the appliance is configured as a SAML Identity Provider. Coordinated scanning and confirmed exploitation against the /saml/login endpoint was detected by Lupovis decoy sensors within 24 hours of disclosure, before the flaw was added to CISA KEV. It is the third NetScaler authentication-stack memory-disclosure bug in three years, following CVE-2023-4966 (original CitrixBleed, weaponized by LockBit 3.0) and CVE-2026-3055 (March 2026, CitrixBleed 3, KEV-listed).

CVE-2026-8451 is an out-of-bounds read (CWE-125) in the custom XML attribute parser Citrix NetScaler ADC and NetScaler Gateway use to process SAML AuthnRequest documents on appliances configured as a SAML Identity Provider (IdP). The parser's attribute-value tokenizer only terminates an unquoted attribute value when it encounters a NUL byte, a closing '>' character, or a matching quote — it does not treat whitespace or a newline as a terminator. An attacker who sends a bare `<samlp:AuthnRequest` tag padded with hundreds of spaces and no closing attribute or tag causes the parser to keep consuming bytes past the end of the intended buffer, reading into adjacent process heap memory. The overread bytes are embedded, base64-encoded, in the `NSC_TASS` response cookie (the same cookie field that legitimately carries the parsed `ID` and `AssertionConsumerServiceURL` values), giving an unauthenticated remote attacker a repeatable memory-disclosure primitive capable of leaking session tokens, SAML assertions, LDAP credentials, and internal IP addresses from process memory.

The vulnerability was discovered by watchTowr Labs researcher Aliz Hammond in late March 2026 while reproducing the earlier CVE-2026-3055 ('CitrixBleed 3') SAML IdP overread, and Hammond noted that 'memory management continues to appear fragile within Citrix NetScaler appliances, to the extent that even accidentally misconfiguring an appliance can lead to the disclosure of leaked memory.' Citrix disclosed CVE-2026-8451 on 2026-06-30 as part of security bulletin CTX696604, alongside five related NetScaler flaws (CVE-2026-8452 memory overflow/DoS, CVE-2026-8655 memory overread on Oracle-type load-balancer/DNS-proxy configurations, CVE-2026-10816 unauthenticated arbitrary file read, CVE-2026-10817 TCP-Timestamps-triggered overread, and CVE-2026-13474 an HTTP/2 'bomb' DoS). watchTowr Labs simultaneously published a public Detection Artifact Generator reproducing the exact overread pattern (a bare AuthnRequest tag padded with 476 spaces and a trailing newline).

Within less than 24 hours of disclosure, Lupovis decoy-sensor infrastructure detected a single actor operating from 146.70.139.154 (M247 Europe SRL, AS9009, Frankfurt, Germany) systematically validating targets before exploiting them: the actor probed Sensor A twice (404 responses), then Sensor B (404), then Sensor C, which returned a 200 — at which point the actor immediately delivered the full CVE-2026-8451 exploit payload matching watchTowr's published Detection Artifact Generator almost byte-for-byte. All requests carried the `python-requests/2.32.5` User-Agent, consistent with scripted, automated tooling rather than manual exploitation. As of the initial disclosure window CVE-2026-8451 had not yet been added to the CISA KEV catalog, mirroring the pattern seen with CVE-2026-3055 and the original CitrixBleed, where confirmed in-the-wild exploitation preceded formal KEV listing by weeks, leaving organizations that rely solely on KEV-driven patch prioritization exposed during the gap.

CVE-2026-8451 is the latest entry in a recurring NetScaler authentication-stack memory-disclosure lineage: the original CitrixBleed (CVE-2023-4966, 2023) was weaponized at scale by LockBit 3.0 ransomware affiliates against victims including a Boeing parts-distribution subsidiary and the U.S. branch of ICBC, with stolen session tokens shown to survive patching; CVE-2025-5777 ('CitrixBleed 2') and CVE-2025-6543/CVE-2025-7775 followed in 2025; and CVE-2026-3055 ('CitrixBleed 3', CVSS v4 9.3) introduced the SAML IdP and WS-Federation attack surface in March 2026 and was added to CISA KEV on 2026-03-30 after large-scale exploitation (later reported by Fortinet) via crafted requests to /saml/login (omitting AssertionConsumerServiceURL) and /wsfed/passive?wctx (empty wctx parameter). NetScaler ADC and Gateway appliances are commonly deployed at the network perimeter as VPN termination points, application-delivery controllers, and SAML-based SSO identity providers; Shadowserver tracks roughly 30,000 internet-facing NetScaler ADC instances and over 2,300 Gateway instances, giving this vulnerability class a very large potential attack surface across virtually every sector that relies on Citrix remote-access infrastructure.

MITRE ATT&CK techniques used in TL-2026-1140

Collection

T1005 Data from Local System; T1119 Automated Collection

Exfiltration

T1020 Automated Exfiltration

Discovery

T1046 Network Service Discovery; T1518 Software Discovery

Persistence

T1078 Valid Accounts

command-and-control

T1090.002 External Proxy

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services; T1550.004 Web Session Cookie

Defense Evasion

T1211 Exploitation for Defense Evasion

Credential Access

T1212 Exploitation for Credential Access; T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1606 Forge Web Credentials

Impact

T1498 Network Denial of Service; T1499.004 Application or System Exploitation

Resource Development

T1583.003 Virtual Private Server; T1588.002 Obtain Capabilities; T1588.005 Exploits; T1588.006 Vulnerabilities

Reconnaissance

T1590.005 IP Addresses; T1595.001 Active Scanning; T1595.002 Vulnerability Scanning; T1596 Search Open Technical Databases

reconnaissance

T1592.002 Software

Affected products and versions in CitrixBleed 2.0

  • Citrix — NetScaler ADC
    Vulnerable versions: 14.1 before 14.1-72.61; 13.1 before 13.1-63.18
    Fixed in: 14.1-72.61; 13.1-63.18
  • Citrix — NetScaler Gateway
    Vulnerable versions: 14.1 before 14.1-72.61; 13.1 before 13.1-63.18
    Fixed in: 14.1-72.61; 13.1-63.18
  • Citrix — NetScaler ADC FIPS
    Vulnerable versions: before 14.1-72.61 FIPS
    Fixed in: 14.1-72.61 FIPS
  • Citrix — NetScaler ADC FIPS and NDcPP
    Vulnerable versions: 13.1 before 13.1-37.272
    Fixed in: 13.1-37.272

Remediation for CitrixBleed 2.0

Patches

  • NetScaler ADC and NetScaler Gateway 14.1-72.61 or later
  • NetScaler ADC and NetScaler Gateway 13.1-63.18 or later
  • NetScaler ADC FIPS 14.1-72.61 FIPS or later
  • NetScaler ADC FIPS and NDcPP 13.1-37.272 or later

Immediate actions

  • Apply Citrix Security Bulletin CTX696604 patches to all NetScaler ADC/Gateway appliances immediately: 14.1-72.61 or later, or 13.1-63.18 or later; prioritize any appliance configured as a SAML Identity Provider or internet-facing.
  • Audit NetScaler configuration for 'add authentication samlIdPProfile' entries to identify which appliances are configured as a SAML IdP and therefore exploitable via CVE-2026-8451.
  • Hunt proxy/WAF/appliance logs for POST requests to /saml/login containing a bare or malformed <samlp:AuthnRequest> tag with long runs of unquoted whitespace and no closing attribute/tag, and for anomalously large NSC_TASS response cookies.
  • Block or closely monitor traffic from 146.70.139.154 and review logs for the python-requests/2.32.5 User-Agent probing authentication endpoints.
  • Treat any SAML-IdP-configured, internet-facing appliance that was unpatched during the disclosure window as potentially compromised: rotate session tokens, SAML signing certificates, and LDAP service credentials, consistent with the CitrixBleed lineage lesson that stolen session material survives patching.

Workarounds

  • Disable the SAML IdP configuration (remove/disable 'authentication samlIdPProfile') on appliances that cannot be patched immediately.
  • Restrict network access to /saml/login and other authentication endpoints to trusted source IP ranges at the perimeter until the appliance is patched.

Longer-term hardening

  • Deploy WAF/IPS signatures to detect malformed SAMLRequest/AuthnRequest XML (unquoted attribute values not terminated by whitespace) and abnormally large NSC_TASS cookies.
  • Reduce internet exposure of NetScaler management and authentication endpoints; segment SAML IdP functionality away from direct internet reachability where feasible.
  • Evaluate migrating SAML IdP responsibilities to a dedicated, purpose-built identity provider rather than NetScaler-hosted SAML IdP to shrink this recurring attack surface.
  • Establish accelerated internal patch SLAs specifically for NetScaler authentication-stack CVEs given the demonstrated pattern of exploitation preceding CISA KEV listing by weeks.
  • Build persistent detection content (SIEM/EDR) for the CitrixBleed vulnerability class covering all known variants (CVE-2023-4966, CVE-2025-5777, CVE-2026-3055, CVE-2026-8451) rather than patch-and-forget per CVE.

CVEs associated with CitrixBleed 2.0

CVE-2026-8451, CVE-2023-4966, CVE-2026-3055

Weaknesses (CWE) in CitrixBleed 2.0

CWE-125

Timeline of CitrixBleed 2.0

Showing the 20 most recent tracked events.

  • watchTowr Labs researcher Aliz Hammond discovers CVE-2026-8451 while reproducing CVE-2026-3055, identifying a distinct out-of-bounds read in the same SAML AuthnRequest XML parser caused by unterminated unquoted attribute values.
  • CISA adds CVE-2026-3055 to the KEV catalog with a federal patch deadline of 2026-04-02.
  • watchTowr Labs requests a fix-status update from Citrix on the reported CVE-2026-8451 vulnerability.
  • Citrix confirms a fix is in development for CVE-2026-8451.
  • Public disclosure of the watchTowr CVE-2026-8451 research is scheduled for 2026-06-29.
  • Citrix announces a delay to the planned CVE-2026-8451 patch release.
  • Lupovis decoy-sensor infrastructure first detects exploitation attempts against CVE-2026-8451, within hours of public disclosure.
  • Citrix publishes Security Bulletin CTX696604 disclosing CVE-2026-8451 and five related NetScaler flaws (CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, CVE-2026-13474); watchTowr Labs simultaneously publishes a public Detection Artifact Generator reproducing the CVE-2026-8451 overread pattern.
  • CrowdSec publishes a detection rule for CVE-2026-8451 exploitation attempts, one day after the Citrix CTX696604 advisory.
  • eSentire's Threat Response Unit independently confirms CVE-2026-8451 exploitation attempts against its own sensors, separate from the Lupovis telemetry; attempts were unsuccessful with no observed post-compromise activity.
  • Initial July 1 public reporting states no confirmed active exploitation of CVE-2026-8451 had yet been observed, a position superseded within a day by sensor telemetry.
  • A single actor operating from 146.70.139.154 probes three separate Lupovis sensor deployments over a five-hour window (2026-06-30 to 2026-07-01), validating targets with 404-triggering probes before delivering the full exploit payload upon receiving a 200 response.
  • Cybersecurity News publicly confirms CVE-2026-8451 was exploited by hackers within 24 hours of disclosure, citing Lupovis decoy-sensor telemetry; as of this date the CVE remains absent from the CISA KEV catalog.
  • eSentire adds its published CVE-2026-8451 malicious-IP set to its Global Block List and reports network-based detections already deployed against exploitation attempts.
  • eSentire publishes a security advisory on CVE-2026-8451 with a partial malicious-IP list (33 IPs total, including 1.219.44.137, 103.125.218.39, 130.94.18.161) and hunting/detection guidance.
  • A second threat actor, operating from Koapu Cloud infrastructure in Hong Kong, is observed exploiting CVE-2026-8451 using an identical scan-then-exploit pattern to the original Frankfurt-sourced actor.
  • SecurityWeek and other outlets report CVE-2026-8451 was 'exploited immediately after public disclosure,' amplifying awareness of the active-exploitation status.
  • CrowdSec reports 424 CVE-2026-8451 exploitation signals from 71 unique malicious IP addresses over the preceding four days (peak 127 signals in a single day), characterizing the activity as broad, automated, minimally-filtered scanning aimed at infrastructure takeover, with confirmed victim telemetry in South Africa, Germany, the UK, and France.
  • watchTowr publishes binary-diffing analysis showing sibling CVE-2026-8452 (same CTX696604 bundle as CVE-2026-8451) is a remote-code-execution-capable write-what-where heap overflow, not merely a denial-of-service bug as Citrix's original advisory described.
  • CISA adds sibling CVE-2026-8452 to the Known Exploited Vulnerabilities catalog under Binding Operational Directive 26-04, with a 2026-08-29 federal remediation deadline; CVE-2026-8451 itself remains unlisted in KEV as of this writing.

Update history for TL-2026-1140

Sources cited for CitrixBleed 2.0

Detection coverage for TL-2026-1140

As of 2026-09-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1140 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
35 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats