No Crash Required: Verifying the Citrix NetScaler SAML Patch for CVE-2026-8452

TL;DR

CVE-2026-8452">CVE-2026-8452 is a memory corruption bug, a heap overflow, in the code that parses SAML single sign-on messages on Citrix NetScaler ADC and Gateway. It is rated CVSS 8.8 and needs no login to trigger. An attacker who can reach a Gateway or AAA virtual server with SAML configured corrupts memory in the process that carries all traffic through the appliance, using a single HTTP request, potentially causing remote code execution. Upgrade to the latest available 13.1 or 14.1 build , then confirm the upgrade took effect on every virtual server. Patch state is measurable from outside in one or two ordinary SAML requests, with no crash and no disruption to live sessions. We published that check as a CVE-2026-8452-check">detection tool covering both sides of the SAML exchange. Read on for specific guidance on the indicators of compromise to hunt for, including one crash signal that does not mean what it appears to mean.…