# Citrix NetScaler ADC/Gateway Pre-Auth RCE via SAML Heap Overflow (CVE-2026-8452) Exploited in the Wild

> CVE-2026-8452 is a pre-authentication heap overflow in the SAML signature canonicalization code of the NetScaler packet processing engine (nsppe). Citrix patched it on 2026-06-30 as a denial-of-service issue; watchTowr Labs showed on 2026-08-14 that it yields unauthenticated root RCE. CISA added it to KEV on 2026-08-26 after web-shell exploitation was observed.

- **Published:** 2026-10-12T01:38:36Z
- **Last reviewed:** 2026-10-12T01:38:36Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3321
- **ID:** TL-2026-3321
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-8452

## Description

CVE-2026-8452 affects NetScaler ADC and NetScaler Gateway appliances configured as a Gateway virtual server (SSL VPN, ICA Proxy, Clientless VPN, RDP Proxy) or as an AAA virtual server, where the SAML authentication flow (Service Provider or Identity Provider mode) is exposed. Load-balancer-only configurations are not affected. Citrix disclosed the flaw on 2026-06-30 in security bulletin CTX696604 as a memory overflow leading to unpredictable behavior and denial of service (NVD: CVSS 3.1 9.8, CVSS 4.0 8.8, CWE-119), alongside five other NetScaler CVEs (CVE-2026-8451, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, CVE-2026-13474). The article that prompted this record notes the CVE assignment was initially suspected rather than confirmed by Citrix; NVD and CISA subsequently list CVE-2026-8452 for this flaw.

Root cause (watchTowr Labs, 2026-08-14): when nsppe canonicalizes the SignedInfo element of a signed SAML message, it copies data into a fixed-size global buffer without bounds checking. The attacker-controlled PrefixList attribute of the InclusiveNamespaces element inside CanonicalizationMethod can hold an arbitrarily long list of unique space-separated tokens (the PoC used roughly 2,000 tokens N0..N1999). The oversized list overflows the buffer into the adjacent heap chunk metadata, making the neighbouring chunk's data pointer (offset +0x50) attacker-controlled. A later memcpy in splitPktInner() then uses that pointer as destination, giving a write-what-where primitive. Overwriting the function pointer tx_pkt_complete_fptr redirects execution via jmp rax to shellcode placed on an RWX heap.

Post-exploitation in the research PoC: shellcode first crashed nsppe, so signal handlers were neutralized with sigaction() syscalls to stop the automatic restart/reboot (the pitboss process monitor is referenced in third-party analysis). A PHP web shell initially ran as nobody; the SUID bit was set on /bin/sh to reach root, and a PHP web shell written to /var/vpn/theme/x.php survived process respawn.

In-the-wild activity: after the watchTowr write-up, CISA and secondary reporting describe opportunistic 'spray and pray' exploitation that drops web shells (x.php and z.php) and runs discovery commands (id, echo). Help Net Security reports multiple actors from three countries; Cloud Security Alliance reports 36 distinct attempts over 12 days from 12 unique source IPs (sources in Switzerland, Germany, Hong Kong, Japan, Netherlands, Russia, Singapore, Turkiye, United States and Vietnam). No source publishes the attacker IP addresses, hashes or domains, and no actor attribution has been made. Shadowserver tracks more than 22,000 internet-exposed NetScaler ADC and nearly 1,800 Gateway instances (not distinguishing vulnerable from patched). The patch adds explicit size checks around the buffer copies in SAML canonicalization (the patched code rejects an oversized SignedInfo, v73 >= 0x1001). Patching does not evict an attacker already present; defenders should hunt for unexpected PHP files, terminate sessions and rotate credentials on appliances that were exposed and unpatched.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1505.003 Web Shell
- T1548.001 Setuid and Setgid
- T1685 Disable or Modify Tools
- T1033 System Owner/User Discovery
- T1499.004 Application or System Exploitation

## Sources

- [You're Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?)) - watchTowr Labs](https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452/)
- [NVD - CVE-2026-8452](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-8452)
- [Multiple Vulnerabilities in NetScaler Products (AL-2026-082) - CSA Singapore](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-082/)
- [H-ISAC TLP:White Threat Bulletin: PoC Exploit Available for Citrix NetScaler ADC and Gateway (CVE-2026-8452)](https://www.aha.org/system/files/media/file/2026/08/h-isac-tlp-white-threat-bulletin-poc-exploit-available-for-citrix-netscaler-adc-and-gateway-cve-2026-8452-8-17-2026.pdf)
- [Arctic Wolf Security Bulletin: CVE-2026-8452](https://arcticwolf.com/?p=137251)
- [Previously patched Citrix NetScaler flaw exploited in the wild (CVE-2026-8452) - Help Net Security](https://www.helpnetsecurity.com/2026/08/27/netscaler-adc-gateway-cve-2026-8452/)
- [CISA: Hackers now exploiting Citrix NetScaler RCE flaw in attacks - BleepingComputer](https://www.bleepingcomputer.com/news/security/cisa-hackers-now-exploiting-citrix-netscaler-rce-flaw-in-attacks/)
- [CSA Research Note: CVE-2026-8452 NetScaler DoS Flaw Now Unauthenticated RCE](https://labs.cloudsecurityalliance.org/research/csa-research-note-citrix-netscaler-cve-2026-8452-exploited-2/)
- [CVE-2026-8452: Citrix NetScaler Exploited (KEV) - OpenVPN Blog](https://blog.openvpn.net/cve-2026-8452-citrix-netscaler-exploited)
- [Citrix NetScaler CVE-2026-8452 Is in CISA KEV: Patch Before August 29](https://aicybr.com/blog/citrix-netscaler-cve-2026-8452-kev)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3321