Threat reportVulnerabilityTL-2026-3321
Citrix NetScaler ADC/Gateway Pre-Auth RCE via SAML Heap Overflow (CVE-2026-8452) Exploited in the Wild
Citrix NetScaler ADC/Gateway Pre-Auth RCE via SAML Heap (TL-2026-3321), also tracked as You're Back In The Room, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-10-12. It has no confirmed attribution, affects Citrix (Cloud Software Group) NetScaler ADC, references 1 CVE (CVE-2026-8452), maps to 7 MITRE ATT&CK techniques (T1033, T1059.004, T1190), and is covered by 9 detection rules and 6 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 6Indicators of compromise
Key facts for TL-2026-3321
- Threat ID
- TL-2026-3321
- Also known as
- You're Back In The Room
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, finance, health, technology, telecoms, education
- Target regions
- Global, North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 6
How Citrix NetScaler ADC/Gateway Pre-Auth RCE via SAML Heap works
CVE-2026-8452 is a pre-authentication heap overflow in the SAML signature canonicalization code of the NetScaler packet processing engine (nsppe). Citrix patched it on 2026-06-30 as a denial-of-service issue; watchTowr Labs showed on 2026-08-14 that it yields unauthenticated root RCE. CISA added it to KEV on 2026-08-26 after web-shell exploitation was observed.
CVE-2026-8452 affects NetScaler ADC and NetScaler Gateway appliances configured as a Gateway virtual server (SSL VPN, ICA Proxy, Clientless VPN, RDP Proxy) or as an AAA virtual server, where the SAML authentication flow (Service Provider or Identity Provider mode) is exposed. Load-balancer-only configurations are not affected. Citrix disclosed the flaw on 2026-06-30 in security bulletin CTX696604 as a memory overflow leading to unpredictable behavior and denial of service (NVD: CVSS 3.1 9.8, CVSS 4.0 8.8, CWE-119), alongside five other NetScaler CVEs (CVE-2026-8451, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, CVE-2026-13474). The article that prompted this record notes the CVE assignment was initially suspected rather than confirmed by Citrix; NVD and CISA subsequently list CVE-2026-8452 for this flaw.
Root cause (watchTowr Labs, 2026-08-14): when nsppe canonicalizes the SignedInfo element of a signed SAML message, it copies data into a fixed-size global buffer without bounds checking. The attacker-controlled PrefixList attribute of the InclusiveNamespaces element inside CanonicalizationMethod can hold an arbitrarily long list of unique space-separated tokens (the PoC used roughly 2,000 tokens N0..N1999). The oversized list overflows the buffer into the adjacent heap chunk metadata, making the neighbouring chunk's data pointer (offset +0x50) attacker-controlled. A later memcpy in splitPktInner() then uses that pointer as destination, giving a write-what-where primitive. Overwriting the function pointer tx_pkt_complete_fptr redirects execution via jmp rax to shellcode placed on an RWX heap.
Post-exploitation in the research PoC: shellcode first crashed nsppe, so signal handlers were neutralized with sigaction() syscalls to stop the automatic restart/reboot (the pitboss process monitor is referenced in third-party analysis). A PHP web shell initially ran as nobody; the SUID bit was set on /bin/sh to reach root, and a PHP web shell written to /var/vpn/theme/x.php survived process respawn.
In-the-wild activity: after the watchTowr write-up, CISA and secondary reporting describe opportunistic 'spray and pray' exploitation that drops web shells (x.php and z.php) and runs discovery commands (id, echo). Help Net Security reports multiple actors from three countries; Cloud Security Alliance reports 36 distinct attempts over 12 days from 12 unique source IPs (sources in Switzerland, Germany, Hong Kong, Japan, Netherlands, Russia, Singapore, Turkiye, United States and Vietnam). No source publishes the attacker IP addresses, hashes or domains, and no actor attribution has been made. Shadowserver tracks more than 22,000 internet-exposed NetScaler ADC and nearly 1,800 Gateway instances (not distinguishing vulnerable from patched). The patch adds explicit size checks around the buffer copies in SAML canonicalization (the patched code rejects an oversized SignedInfo, v73 >= 0x1001). Patching does not evict an attacker already present; defenders should hunt for unexpected PHP files, terminate sessions and rotate credentials on appliances that were exposed and unpatched.
MITRE ATT&CK techniques used in TL-2026-3321
Discovery
T1033 System Owner/User Discovery
Execution
Initial Access
T1190 Exploit Public-Facing Application
Impact
T1499.004 Application or System Exploitation
Persistence
Privilege Escalation
defense-impairment
Affected products and versions in Citrix NetScaler ADC/Gateway Pre-Auth RCE via SAML Heap
- Citrix (Cloud Software Group) — NetScaler ADC
Vulnerable versions: 14.1 before 14.1-72.61; 13.1 before 13.1-63.18; 14.1 FIPS before 14.1-72.61 FIPS; 13.1 FIPS/NDcPP before 13.1-37.272
Fixed in: 14.1-72.61; 13.1-63.18; 14.1-72.61 FIPS; 13.1-37.272 - Citrix (Cloud Software Group) — NetScaler Gateway
Vulnerable versions: 14.1 before 14.1-72.61; 13.1 before 13.1-63.18
Fixed in: 14.1-72.61; 13.1-63.18
Remediation for Citrix NetScaler ADC/Gateway Pre-Auth RCE via SAML Heap
Patches
- NetScaler ADC/Gateway 14.1-72.61 or later (14.1-73.32 and later cited as current)
- NetScaler ADC/Gateway 13.1-63.18 or later (13.1-63.21 and later cited as current)
- NetScaler ADC 14.1 FIPS 14.1-72.61 FIPS or later
- NetScaler ADC 13.1 FIPS/NDcPP 13.1-37.272 or later
Immediate actions
- Identify NetScaler appliances configured with 'add vpn vserver' (Gateway) or 'add authentication vserver' (AAA) and prioritize internet-facing ones
- Upgrade all nodes, including HA/cluster pairs, to fixed builds per CTX696604
- If patching is delayed, temporarily disable SAML context with: nsapimgr_wr.sh -ys call=ns_aaa_saml_disable_context
- Hunt for unexpected PHP files such as x.php and z.php, particularly under /var/vpn/theme/
- After patching, terminate active sessions and rotate credentials on appliances that were exposed while unpatched
Workarounds
- Disable SAML authentication if not required
- CVE-2026-13474 (same bulletin): set Http2SmallWndTimeout to 30 seconds on affected systems
Longer-term hardening
- Restrict SAML IdP/SP endpoints and management access to trusted networks or allow-lists
- Alert on nsppe crashes/restarts and on SAML requests with oversized PrefixList attributes (>4096 bytes)
- Maintain an inventory of NetScaler build numbers and subscribe to Citrix security bulletins
CVEs associated with Citrix NetScaler ADC/Gateway Pre-Auth RCE via SAML Heap
Weaknesses (CWE) in Citrix NetScaler ADC/Gateway Pre-Auth RCE via SAML Heap
Timeline of Citrix NetScaler ADC/Gateway Pre-Auth RCE via SAML Heap
- Citrix publishes bulletin CTX696604 and patched builds; CVE-2026-8452 is described as a memory overflow causing unpredictable behavior and denial of service on Gateway/AAA virtual servers.
- CSA Singapore alert AL-2026-082 lists CVE-2026-8452 (CVSS 8.8) among six NetScaler vulnerabilities and urges immediate patching.
- watchTowr Labs publishes a technical write-up showing the flaw is a SAML canonicalization heap overflow leading to unauthenticated root RCE, with a working exploit.
- H-ISAC issues a TLP:White bulletin warning that a PoC exploit is available for CVE-2026-8452.
- Arctic Wolf bulletin reports no confirmed in-the-wild exploitation at that time and advises patching, disabling the SAML context and terminating sessions.
- CISA adds CVE-2026-8452 to the Known Exploited Vulnerabilities catalog after web-shell exploitation is observed.
- Help Net Security, BleepingComputer and CSA report spray-and-pray exploitation dropping x.php and z.php web shells and running id/echo discovery commands.
- Federal remediation deadline under CISA BOD 26-04 for CVE-2026-8452.
Sources cited for Citrix NetScaler ADC/Gateway Pre-Auth RCE via SAML Heap
- You're Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?)) - watchTowr Labs
- NVD - CVE-2026-8452
- Multiple Vulnerabilities in NetScaler Products (AL-2026-082) - CSA Singapore
- H-ISAC TLP:White Threat Bulletin: PoC Exploit Available for Citrix NetScaler ADC and Gateway (CVE-2026-8452)
- Arctic Wolf Security Bulletin: CVE-2026-8452
- Previously patched Citrix NetScaler flaw exploited in the wild (CVE-2026-8452) - Help Net Security
- CISA: Hackers now exploiting Citrix NetScaler RCE flaw in attacks - BleepingComputer
- CSA Research Note: CVE-2026-8452 NetScaler DoS Flaw Now Unauthenticated RCE
- CVE-2026-8452: Citrix NetScaler Exploited (KEV) - OpenVPN Blog
- Citrix NetScaler CVE-2026-8452 Is in CISA KEV: Patch Before August 29
Detection coverage for TL-2026-3321
As of 2026-10-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3321 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.