Which versions of NetScaler ADC are affected by EUVD-2026-40305?

Citrix NetScaler ADC and Gateway appliances configured as SAML identity providers are vulnerable to unauthenticated memory disclosure attacks, exposing authentication tokens and session credentials…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-40305?

Yes, a public proof-of-concept exploit is available for EUVD-2026-40305. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate EUVD-2026-40305?

Within 24 hours: Identify all NetScaler ADC/Gateway instances in SAML IDP mode; disable SAML IDP functionality if business-critical alternatives exist; enable detailed request/response logging on identity provider endpoints. Within 7 days: Implement network segmentation to limit SAML authentication traffic to trusted internal networks and administrative access to NetScaler management interfaces; escalate with Citrix support for patch timeline and interim workarounds; review access logs for exploitation attempts. Within 30 days: Develop upgrade plan to patched version upon release; implement WAF rules to detect out-of-bounds memory access patterns; evaluate migration to alternative identity providers if Citrix patch timeline exceeds risk tolerance.

NetScaler ADC EUVD-2026-40305

Q: What is the CVSS score of EUVD-2026-40305?

EUVD-2026-40305 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-8451 HIGH

Out-of-bounds Read (CWE-125)

2026-06-30 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

GHSA-6659-v5cc-894x

Citrix Information Disclosure Buffer Overflow Netscaler Application Delivery Controller Netscaler Gateway

8.8

CVSS 4.0 · Vendor: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

Severity by source

Vendor (50a63c94-1ea7-4568-8c11-eb79e7c5a2b5) PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

ENISA EUVD

HIGH

qualitative

vuln.today AI

9.1 CRITICAL

SAML IDP endpoint is remotely reachable and unauthenticated (PR:N, AV:N, AC:L); memory overread yields high confidentiality and crash-driven availability impact, with no integrity effect (I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (50a63c94-1ea7-4568-8c11-eb79e7c5a2b5).

CVSS VectorVendor: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 30, 2026 - 15:01 EUVD

Analysis Generated

Jun 30, 2026 - 13:33 vuln.today

CVE Published

Jun 30, 2026 - 13:19 cve.org

HIGH 8.8

DescriptionCVE.org

Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML IDP

Articles & Coverage 2

vulnerability.circl.lu CVE-2026-8451: Pre-Auth Memory Overread in Citrix NetScaler Continues Endemic CitrixBleed Vulnerability Class Jul 01, 2026 POC CVE-2026-8451: Citrix NetScaler Memory Overread PoC Leaks Sensitive Device Memory Jun 30, 2026

AnalysisAI

Memory overread in Citrix NetScaler ADC and NetScaler Gateway lets remote attackers read out-of-bounds memory when the appliance is configured as a SAML identity provider (IDP), enabling disclosure of sensitive in-memory data such as tokens, session material, or other process memory. The CVSS 4.0 score of 8.8 reflects network-reachable, unauthenticated exploitation (PR:N) with high confidentiality and availability impact; no public exploit identified at time of analysis and the issue is not listed in CISA KEV. The flaw belongs to the same class of NetScaler appliance vulnerabilities (e.g., Citrix Bleed-style memory disclosure) that have historically drawn aggressive exploitation, making prompt patching advisable.

Technical ContextAI

NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway are enterprise application delivery controllers and remote-access gateways that can act as a SAML identity provider to broker single sign-on. The vulnerability stems from insufficient input validation in the SAML IDP code path, which causes the appliance to read beyond the bounds of an allocated buffer (a memory overread / out-of-bounds read, conceptually CWE-125, though the input lists CWE as N/A). When parsing attacker-controlled SAML protocol input, the missing length/bounds check allows adjacent process memory to be returned or leaked, exposing data that should not be accessible. Exact affected CPE strings are not provided in the input; identification relies on the Citrix advisory referenced (CTX696604).

RemediationAI

Apply the fixed firmware build published by Citrix in advisory CTX696604 (https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604); no vendor-released patch version is enumerated in the provided input data, so retrieve the exact upgrade target for your release train directly from that advisory - Patch available per vendor advisory. As a compensating control where immediate patching is not possible, disable or remove the SAML IDP configuration on the appliance, which directly removes the vulnerable code path but breaks SAML-based single sign-on flows that depend on NetScaler acting as the IDP; alternatively restrict network reachability to the SAML IDP endpoints to trusted networks via firewall/ACL, accepting reduced accessibility for legitimate remote users. After patching, rotate any secrets, session tokens, or credentials that may have been exposed through memory disclosure.