Which versions of NetScaler ADC are affected by CVE-2026-8452?

Citrix NetScaler ADC and Gateway devices used for SSL VPN, ICA Proxy, and RDP gateway services face a critical remote denial-of-service and memory corruption vulnerability exploitable by…. A patch is available.

Is there a public PoC exploit available for CVE-2026-8452?

Yes, a public proof-of-concept exploit is available for CVE-2026-8452. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-8452?

24 hours: Inventory and assess which NetScaler devices in your environment are deployed as SSL VPN, ICA Proxy, CVPN, or RDP Proxy; implement network-level access restrictions if feasible. 7 days: Contact Citrix for patch timeline; deploy rate limiting and DDoS mitigation on affected appliances; enable enhanced logging for anomalies. 30 days: Deploy vendor patch upon release; validate IPS signatures to detect CVE-2026-8452 exploitation attempts.

NetScaler ADC CVE-2026-8452

Q: What is the CVSS score of CVE-2026-8452?

CVE-2026-8452 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-40307 HIGH

Buffer Overflow (CWE-119)

2026-06-30 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

GHSA-r7wg-r5wj-c765

Citrix Denial Of Service Buffer Overflow Netscaler Application Delivery Controller Netscaler Gateway

8.8

CVSS 4.0 · Vendor: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

Severity by source

Vendor (50a63c94-1ea7-4568-8c11-eb79e7c5a2b5) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

ENISA EUVD

HIGH

qualitative

vuln.today AI

9.4 CRITICAL

Remotely reachable, low-complexity, unauthenticated memory overflow on Gateway/AAA virtual servers; high availability (DoS) and confidentiality (memory exposure) impact with limited integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (50a63c94-1ea7-4568-8c11-eb79e7c5a2b5).

CVSS VectorVendor: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Added to CISA KEV

Aug 26, 2026 - 17:47 CISA

Patch available

Jun 30, 2026 - 15:01 EUVD

Analysis Generated

Jun 30, 2026 - 13:34 vuln.today

CVE Published

Jun 30, 2026 - 13:19 cve.org

HIGH 8.8

DescriptionCVE.org

Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server

Articles & Coverage 1

POC CVE-2026-8452: Pre-Auth Heap Overflow RCE in Citrix NetScaler ADC/Gateway via SAML Aug 14, 2026

AnalysisAI

Denial of service and memory corruption in Citrix NetScaler ADC and NetScaler Gateway allows remote unauthenticated attackers to trigger unpredictable or erroneous appliance behavior when the device is deployed as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity exploitation with no authentication, and the high confidentiality impact suggests memory contents may be exposed alongside the DoS condition. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV.

Technical ContextAI

NetScaler ADC and NetScaler Gateway are Citrix's application delivery controller and remote-access gateway appliances, terminating SSL VPN, ICA Proxy, Clientless VPN (CVPN), RDP Proxy, and AAA authentication sessions at the network edge. The flaw is a memory overflow (a buffer/heap memory-safety defect; CWE not assigned in the source data) in the request-handling paths exposed by these Gateway and AAA front-ends. NetScaler edge appliances have historically been affected by memory-handling bugs in these same TCP/HTTP/SSL-VPN code paths (the CitrixBleed family), where over-read or overflow conditions both crash the service and can leak adjacent process memory - consistent with the high confidentiality and availability impacts recorded here. No CPE strings were supplied, so exact affected build numbers must be confirmed from the Citrix advisory.

RemediationAI

Apply the fixed NetScaler ADC and NetScaler Gateway builds published by Citrix in advisory CTX696604 (https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604); exact fixed build numbers were not in the provided data, so consult that advisory for the precise patched versions for your release train. No vendor-released fix version was supplied here, so treat the advisory as authoritative for version numbers - do not rely on inferred values. As a compensating control where immediate patching is not possible, restrict network reachability of the Gateway/AAA virtual servers (for example, place the management and VPN endpoints behind IP allow-lists or a VPN concentrator, or temporarily unbind unused Gateway features such as RDP Proxy or CVPN); the trade-off is reduced remote-access functionality for users relying on those services. Avoid exposing the affected virtual servers directly to the open internet until patched.