# CitrixBleed 2.0: CVE-2026-8451 NetScaler SAML IDP Memory Overread Under Active Exploitation

> Citrix disclosed CVE-2026-8451 on 2026-06-30 (bulletin CTX696604), a pre-authentication out-of-bounds memory read in NetScaler ADC/Gateway's custom SAML AuthnRequest XML parser when the appliance is configured as a SAML Identity Provider. Coordinated scanning and confirmed exploitation against the /saml/login endpoint was detected by Lupovis decoy sensors within 24 hours of disclosure, before the flaw was added to CISA KEV. It is the third NetScaler authentication-stack memory-disclosure bug in three years, following CVE-2023-4966 (original CitrixBleed, weaponized by LockBit 3.0) and CVE-2026-3055 (March 2026, CitrixBleed 3, KEV-listed).

- **Published:** 2026-06-30T00:00:00Z
- **Last reviewed:** 2026-09-09T23:12:38.335Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1140
- **ID:** TL-2026-1140
- **Severity:** CRITICAL (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-8451, CVE-2023-4966, CVE-2026-3055

## Description

CVE-2026-8451 is an out-of-bounds read (CWE-125) in the custom XML attribute parser Citrix NetScaler ADC and NetScaler Gateway use to process SAML AuthnRequest documents on appliances configured as a SAML Identity Provider (IdP). The parser's attribute-value tokenizer only terminates an unquoted attribute value when it encounters a NUL byte, a closing '>' character, or a matching quote — it does not treat whitespace or a newline as a terminator. An attacker who sends a bare `<samlp:AuthnRequest` tag padded with hundreds of spaces and no closing attribute or tag causes the parser to keep consuming bytes past the end of the intended buffer, reading into adjacent process heap memory. The overread bytes are embedded, base64-encoded, in the `NSC_TASS` response cookie (the same cookie field that legitimately carries the parsed `ID` and `AssertionConsumerServiceURL` values), giving an unauthenticated remote attacker a repeatable memory-disclosure primitive capable of leaking session tokens, SAML assertions, LDAP credentials, and internal IP addresses from process memory.

The vulnerability was discovered by watchTowr Labs researcher Aliz Hammond in late March 2026 while reproducing the earlier CVE-2026-3055 ('CitrixBleed 3') SAML IdP overread, and Hammond noted that 'memory management continues to appear fragile within Citrix NetScaler appliances, to the extent that even accidentally misconfiguring an appliance can lead to the disclosure of leaked memory.' Citrix disclosed CVE-2026-8451 on 2026-06-30 as part of security bulletin CTX696604, alongside five related NetScaler flaws (CVE-2026-8452 memory overflow/DoS, CVE-2026-8655 memory overread on Oracle-type load-balancer/DNS-proxy configurations, CVE-2026-10816 unauthenticated arbitrary file read, CVE-2026-10817 TCP-Timestamps-triggered overread, and CVE-2026-13474 an HTTP/2 'bomb' DoS). watchTowr Labs simultaneously published a public Detection Artifact Generator reproducing the exact overread pattern (a bare AuthnRequest tag padded with 476 spaces and a trailing newline).

Within less than 24 hours of disclosure, Lupovis decoy-sensor infrastructure detected a single actor operating from 146.70.139.154 (M247 Europe SRL, AS9009, Frankfurt, Germany) systematically validating targets before exploiting them: the actor probed Sensor A twice (404 responses), then Sensor B (404), then Sensor C, which returned a 200 — at which point the actor immediately delivered the full CVE-2026-8451 exploit payload matching watchTowr's published Detection Artifact Generator almost byte-for-byte. All requests carried the `python-requests/2.32.5` User-Agent, consistent with scripted, automated tooling rather than manual exploitation. As of the initial disclosure window CVE-2026-8451 had not yet been added to the CISA KEV catalog, mirroring the pattern seen with CVE-2026-3055 and the original CitrixBleed, where confirmed in-the-wild exploitation preceded formal KEV listing by weeks, leaving organizations that rely solely on KEV-driven patch prioritization exposed during the gap.

CVE-2026-8451 is the latest entry in a recurring NetScaler authentication-stack memory-disclosure lineage: the original CitrixBleed (CVE-2023-4966, 2023) was weaponized at scale by LockBit 3.0 ransomware affiliates against victims including a Boeing parts-distribution subsidiary and the U.S. branch of ICBC, with stolen session tokens shown to survive patching; CVE-2025-5777 ('CitrixBleed 2') and CVE-2025-6543/CVE-2025-7775 followed in 2025; and CVE-2026-3055 ('CitrixBleed 3', CVSS v4 9.3) introduced the SAML IdP and WS-Federation attack surface in March 2026 and was added to CISA KEV on 2026-03-30 after large-scale exploitation (later reported by Fortinet) via crafted requests to /saml/login (omitting AssertionConsumerServiceURL) and /wsfed/passive?wctx (empty wctx parameter). NetScaler ADC and Gateway appliances are commonly deployed at the network perimeter as VPN termination points, application-delivery controllers, and SAML-based SSO identity providers; Shadowserver tracks roughly 30,000 internet-facing NetScaler ADC instances and over 2,300 Gateway instances, giving this vulnerability class a very large potential attack surface across virtually every sector that relies on Citrix remote-access infrastructure.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1590.005 IP Addresses
- T1588.006 Vulnerabilities
- T1588.005 Exploits
- T1583.003 Virtual Private Server
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1212 Exploitation for Credential Access
- T1552.001 Credentials In Files
- T1539 Steal Web Session Cookie
- T1046 Network Service Discovery
- T1592.002 Software
- T1090.002 External Proxy
- T1119 Automated Collection
- T1550.004 Web Session Cookie
- T1078 Valid Accounts
- T1499.004 Application or System Exploitation
- T1596 Search Open Technical Databases
- T1518 Software Discovery
- T1606 Forge Web Credentials
- T1005 Data from Local System
- T1210 Exploitation of Remote Services
- T1498 Network Denial of Service
- T1595.001 Active Scanning
- T1588.002 Obtain Capabilities
- T1211 Exploitation for Defense Evasion
- T1020 Automated Exfiltration

## Sources

- [New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure](https://cyberscoop.com/citrix-netscaler-flaw-cve-2026-8451-citrixbleed/)
- [CitrixBleed Vulnerability Exploited by Hackers Within 24 Hours of Public Disclosure](https://cybersecuritynews.com/citrixbleed-vulnerability-exploited/)
- [Citrix Support Bulletin CTX696604](https://support.citrix.com/support-home/kbsearch/index?articleId=CTX696604)
- [CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451)](https://labs.watchtowr.com/citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451/)
- [CVE-2026-8451: Citrix NetScaler SAML Memory Overread](https://www.lupovis.io/lupovis-insights/)
- [CVE-2026-3055 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-3055)
- [CVE-2026-3055 & CVE-2026-4368: Inside the NetScaler 'CitrixBleed 3' Memory Overread](https://www.picussecurity.com/resource/blog/cve-2026-3055-cve-2026-4368-inside-the-netscaler-citrixbleed-3-memory-overread)
- [Citrix NetScaler Under Active Recon for CVE-2026-3055 (CVSS 9.3) Memory Overread Bug](https://thehackernews.com/2026/03/citrix-netscaler-under-active-recon-for.html)
- [Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service](https://thehackernews.com/2026/07/citrix-patches-six-netscaler-flaws.html)
- [#StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a)
- [Vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway](https://www.ncsc.gov.uk/news/vulnerabilities-affecting-citrix-netscaler-adc-gateway)
- [Citrix NetScaler SAML IDP Vulnerability (CVE-2026-3055): Large-Scale Exploitation Confirmed by Fortinet](https://threat-modeling.com/citrix-netscaler-saml-idp-cve-2026-3055/)
- [Citrix NetScaler CVE-2026-8451: CitrixBleed-Style Pre-Auth Memory Overread via SAML IdP (Six CVEs)](https://www.josephcharnin.com/cybersecurity/citrix-netscaler-memory-overread-cve-2026-8451/)
- [CVE-2026-8451: Citrix NetScaler Vulnerability Leaks Memory](https://www.esecurityplanet.com/threats/cve-2026-8451-citrix-netscaler-vulnerability-leaks-memory/)
- [CVE-2026-8451 - Memory Overread / Sensitive Data Exposure - NetScaler ADC and NetScaler Gateway](https://www.ionix.io/threat-center/cve-2026-8451/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1140