What is the CVSS score of CVE-2026-8451?

CVE-2026-8451 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.5%.

Is there a public PoC exploit available for CVE-2026-8451?

Yes, a public proof-of-concept exploit is available for CVE-2026-8451. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-8451?

Within 24 hours: Identify all NetScaler ADC/Gateway instances in SAML IDP mode; disable SAML IDP functionality if business-critical alternatives exist; enable detailed request/response logging on identity provider endpoints. Within 7 days: Implement network segmentation to limit SAML authentication traffic to trusted internal networks and administrative access to NetScaler management interfaces; escalate with Citrix support for patch timeline and interim workarounds; review access logs for exploitation attempts. Within 30 days: Develop upgrade plan to patched version upon release; implement WAF rules to detect out-of-bounds memory access patterns; evaluate migration to alternative identity providers if Citrix patch timeline exceeds risk tolerance.

NetScaler ADC CVE-2026-8451

Q: Which versions of NetScaler ADC are affected by CVE-2026-8451?

Citrix NetScaler ADC and Gateway appliances configured as SAML identity providers are vulnerable to unauthenticated memory disclosure attacks, exposing authentication tokens and session credentials…. A patch is available.

EUVD-2026-40305 HIGH

Out-of-bounds Read (CWE-125)

2026-06-30 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

GHSA-6659-v5cc-894x

Buffer Overflow Information Disclosure Citrix Netscaler Application Delivery Controller Netscaler Gateway

8.8

CVSS 4.0 · Vendor: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Locate NetScaler configured as SAML IDP
Delivery

Send crafted SAML request to IDP endpoint
Exploit

Trigger out-of-bounds memory read
Execution

Receive leaked process memory
Impact

Harvest tokens/sensitive data

Vulnerability Assessment

Weakness	CWE CWE-125 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, read limits MITRE ATT&CK 1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires that the NetScaler ADC or NetScaler Gateway appliance be configured as a SAML identity provider (IDP) - this is the exact, named precondition from the description and is the primary limiting factor, since default deployments not using NetScaler as a SAML IDP are not exploitable. Given the CVSS vector (AV:N/AC:L/PR:N/UI:N), where the SAML IDP feature is enabled the attack is remote, unauthenticated, low-complexity, and needs no user interaction against the exposed IDP endpoint. The realistic risk therefore hinges entirely on whether SAML IDP functionality is enabled and network-reachable.
Impact	Signals are largely consistent toward elevated but conditional risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:L/VA:H) indicates a network-reachable, unauthenticated, low-complexity attack with high confidentiality and availability impact - a genuine priority where the precondition is met. The critical limiting factor is configuration dependence: only appliances configured as a SAML IDP are exploitable, so the real-world exposed population is a subset of all NetScaler deployments. No EPSS score, KEV listing, or POC was provided, so probability-of-exploitation and active-exploitation signals are unknown rather than low. The absence of a CWE and CPE data in the input limits precision. Historically, NetScaler memory-disclosure bugs have been rapidly weaponized once details emerge, so the lack of a current POC should not be read as durable safety.
Exploit ScenarioDerived	An attacker identifies an internet-facing NetScaler Gateway acting as a SAML IDP and sends crafted SAML protocol requests to the IDP endpoint without authenticating. The missing input validation triggers an out-of-bounds read, and the appliance returns fragments of process memory that may contain session tokens or other sensitive data, which the attacker harvests to hijack sessions or pivot. No public proof-of-concept is currently identified, but the low attack complexity makes weaponization plausible once technical details circulate.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 30, 2026

Memory overread in Citrix NetScaler ADC and NetScaler Gateway lets remote attackers read out-of-bounds memory when the appliance is configured as a SAML identity provider (IDP), enabling disclosure of sensitive in-memory data such as tokens, session material, or other process memory. The CVSS 4.0 score of 8.8 reflects network-reachable, unauthenticated exploitation (PR:N) with high confidentiality and availability impact; no public exploit identified at time of analysis and the issue is not listed in CISA KEV. The flaw belongs to the same class of NetScaler appliance vulnerabilities (e.g., Citrix Bleed-style memory disclosure) that have historically drawn aggressive exploitation, making prompt patching advisable.

RemediationAI

Apply the fixed firmware build published by Citrix in advisory CTX696604 (https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604); no vendor-released patch version is enumerated in the provided input data, so retrieve the exact upgrade target for your release train directly from that advisory - Patch available per vendor advisory. As a compensating control where immediate patching is not possible, disable or remove the SAML IDP configuration on the appliance, which directly removes the vulnerable code path but breaks SAML-based single sign-on flows that depend on NetScaler acting as the IDP; alternatively restrict network reachability to the SAML IDP endpoints to trusted networks via firewall/ACL, accepting reduced accessibility for legitimate remote users. After patching, rotate any secrets, session tokens, or credentials that may have been exposed through memory disclosure.

Affected VersionsENISA

Gateway 14.1 <72.61

ADC 14.1 FIPs <72.61

ADC 13.1 <63.18

ADC 13.1 FIPS and NDcPP <37.272

Gateway 13.1 <63.18

ADC 14.1 <72.61

Affected Packages

euvd adc fix: 63.18, 72.61

euvd adc_13_1_fips_and_ndcpp fix: 37.272

euvd adc_14_1_fips fix: 72.61

euvd gateway fix: 63.18, 72.61

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 4 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway are enterprise application delivery controllers and remote-access gateways that can act as a SAML identity provider to broker single sign-on. The vulnerability stems from insufficient input validation in the SAML IDP code path, which causes the appliance to read beyond the bounds of an allocated buffer (a memory overread / out-of-bounds read, conceptually CWE-125, though the input lists CWE as N/A). When parsing attacker-controlled SAML protocol input, the missing length/bounds check allows adjacent process memory to be returned or leaked, exposing data that should not be accessible. Exact affected CPE strings are not provided in the input; identification relies on the Citrix advisory referenced (CTX696604).

Know when Netscaler Gateway gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (50a63c94-1ea7-4568-8c11-eb79e7c5a2b5) PRIMARY 8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N

ENISA EUVD HIGH

vuln.today AI 9.1 CRITICAL

SAML IDP endpoint is remotely reachable and unauthenticated (PR:N, AV:N, AC:L); memory overread yields high confidentiality and crash-driven availability impact, with no integrity effect (I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (50a63c94-1ea7-4568-8c11-eb79e7c5a2b5).

CVSS VectorVendor: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

Low

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch available

Jun 30, 2026 - 15:01 EUVD

CVE Published

Jun 30, 2026 - 13:19 cve.org

HIGH 8.8

DescriptionCVE.org

Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML IDP

Articles & Coverage 2

vulnerability.circl.lu CVE-2026-8451: Pre-Auth Memory Overread in Citrix NetScaler Continues Endemic CitrixBleed Vulnerability Class Jul 01, 2026 POC CVE-2026-8451: Citrix NetScaler Memory Overread PoC Leaks Sensitive Device Memory Jun 30, 2026

Executive ViewAI

Why It Matters

Citrix NetScaler ADC and Gateway appliances configured as SAML identity providers are vulnerable to unauthenticated memory disclosure attacks, exposing authentication tokens and session credentials used by federated users across the organization. Any organization relying on these appliances for single sign-on infrastructure faces direct compromise of identity controls and potential lateral movement if tokens are extracted. With no vendor patch currently available and historical precedent for aggressive exploitation of similar Citrix memory-disclosure flaws, rapid containment is essential to prevent credential compromise.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable SAML IDP role on appliances if redundant authentication methods exist; (2) restrict network access to SAML endpoints to internal IP ranges and MFA-protected administrative networks; (3) enable NetScaler request/response logging and forward logs to SIEM for anomaly detection; (4) deploy WAF rules to detect unusual memory-access patterns in HTTP payloads; (5) require re-authentication of all active federation sessions following any detected exploitation attempts; (6) monitor Citrix advisory channels for emergency patches or proof-of-concept mitigations.

Threat Intelligence Overview

EPSS Score

0.5%

Top 59% exploitable

Prevalence

High

widely deployed enterprise remote-access and ADC appliances in large organizations

Threat Intel

1 sources

Exploit

POC

Public exploit code exists

Social Media

Sightings

Data Quality

8 sources

Confidence: High

EUVD Citrix

NVD

CVE.org

EPSS

Vulnrichment NCSC-NL NEWS CIRCL

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.5%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +44

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: +5

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.