CVE-2026-8451

Insufficient input validation leading to memory overread

No known exploitation. EPSS puts it in the 42nd percentile. Fixed versions are out.

CVSS 3.17.5High EPSS percentile42nd0.5% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix4 products5 fixed builds listed below

Published 2026-06-30Updated 2026-07-01Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

NetScaler ADCAffected: ≥ 14.1, < 72.61Upgrade to: 72.61Affected: ≥ 13.1, < 63.18Upgrade to: 63.18Affected: ≥ 14.1 FIPs, < 72.61Upgrade to: 72.61Affected: ≥ 13.1 FIPS and NDcPP, < 37.272Upgrade to: 37.272Stated by: CVE record
NetScaler GatewayAffected: ≥ 14.1, < 72.61Upgrade to: 72.61Affected: ≥ 13.1, < 63.18Upgrade to: 63.18Stated by: CVE record
Citrix Netscaler Application Delivery ControllerAffected: < 13.1-37.272Upgrade to: 13.1-37.272Stated by: NVD
Citrix Netscaler GatewayAffected: ≥ 13.1, < 13.1-63.18Upgrade to: 13.1-63.18Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your NetScaler ADC or NetScaler Gateway is configured as a SAML Identity Provider (IdP).
If it is, plan an update to the fixed versions: ADC or Gateway fixed in 72.61, or 63.18, or 37.272.
After updating, verify the SAML IdP configuration still works and keep the device under normal monitoring for authentication and SAML-related errors.

Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

6 publishers

Threat actors are actively exploiting a new Citrix NetScaler memory overread vulnerability similar to CitrixBleed.
as reported · Aug 27, 2026·SecurityWeek summary
Technical analysis published
as reported · Aug 21, 2026·Bishop Fox summary
Vendor patch released
as reported · Aug 20, 2026·The Hacker News summary
Advisory coverage
as reported · Jul 6, 2026·Check Point Research summary

Sourced from public security reporting — each date is when it was published, not when it happened.

What it is

From the CVE record

Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML IDP

In plain language

Written by AI from the record

CVE-2026-8451 is a security flaw in NetScaler ADC/Gateway that can let an attacker read small bits of sensitive memory if those devices are set up as a SAML Identity Provider; most small businesses should check whether they use NetScaler as a SAML IDP and update if they do.

Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML Identity Provider can trigger a memory overread over the network, potentially disclosing sensitive in-memory data.

If you're affected

Sensitive memory data exposure
Possible credential/token leakage
Security monitoring blind spots
Service integrity risk

What is it

Think of the NetScaler SAML IdP like a translator that handles authentication messages. This bug means that, under the wrong input, it may accidentally read a little extra memory and reveal parts of it. That could expose sensitive data such as internal information or pieces of authentication-related material.

Who is affected

This matters if you run Citrix NetScaler ADC or Citrix NetScaler Gateway and you have configured them to act as a SAML Identity Provider (IdP). Since the attack is network-based, it’s relevant to internet-facing or otherwise reachable deployments. The findings don’t confirm whether authentication is required, so treat it as a risk whenever the SAML IdP functionality is enabled and reachable.

How urgent is it

Verdict: GREEN. There’s no confirmed public exploit code on record and no dated, clearly established real-world exploitation claim in the provided findings. Still, because it can expose sensitive memory contents and the fix is available, you should schedule the update during your next maintenance window or sooner if the SAML IdP is internet-reachable.

What to do — in detail

Confirm exposure (SAML IdP mode)

Determine whether the affected Citrix NetScaler ADC/Gateway instance is configured as a SAML Identity Provider (IdP). The vulnerability precondition in the findings is specifically that NetScaler is used as a SAML IDP.

Identify your current software version and choose the correct fixed target

Use your current release to select the fixed version for your branch.
Fixed versions called out in the findings:
- ADC: fixed in 72.61, 63.18, or 37.272
- Gateway: fixed in 72.61, 63.18, or 37.272

Upgrade procedure

Upgrade to one of the fixed versions above that matches your supported upgrade path (per your release/maintenance policy).
Plan for change-management steps appropriate to your environment (maintenance window, backup/snapshot if your process uses it, and validation of SAML SSO flows).

Validate after the upgrade

Test your SAML sign-in flow end-to-end for representative users.
Watch for SAML-related errors or unusual authentication failures immediately after the upgrade.

If you cannot upgrade right away (workarounds)

The findings don’t provide a specific mitigation beyond updating. As a practical risk reduction step, restrict network exposure of the SAML IdP interfaces (for example, ensure only intended networks/users can reach the SAML IdP endpoints).

What to monitor

Monitor logs for repeated or malformed SAML traffic patterns and authentication anomalies around SAML requests.
Confirm ongoing availability and correctness of SAML responses post-upgrade.

KEV note

This CVE is not listed in the CISA KEV set per the provided findings.

Technical context

Severity is not explicitly stated in the findings, but the capability is “Read sensitive memory contents,” and the weakness is CWE-125 (Out-of-bounds Read) described here as a memory overread triggered by insufficient input validation. Attack vector is network; the precondition is that NetScaler ADC or NetScaler Gateway is configured as a SAML Identity Provider (IdP). Authentication requirement and default reachability are unknown in the findings, so treat this as dependent on whether the SAML IdP surface is reachable and used. Exploitation status: KEV is not listed; no public exploit code is on record in the provided findings; no clear dated press claim of exploitation is included. Patch availability is confirmed with fixed versions for both ADC and Gateway: 72.61, 63.18, and 37.272.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS42nd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.5% chance of exploitation activity in the next 30 days, which ranks it in the 42nd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

12 events over 92 days, from the signal feeds we watch.

2026-09-30EPSS band changemoderate → low
2026-09-24EPSS band changemoderate → lowepss band change
2026-08-03EPSS band changelow → moderate
2026-07-24EPSS band change0 → moderateepss band change
2026-07-15OpenVAS check added
2026-07-01Patch availablerecord updated

Affected products

NetScalercommercial · USaka citrix, netscaler gateway firmware, xenserver, application delivery controller firmware
- ADCOn-premNetworking Infrastructure / load-balancer-proxy
- GatewayOn-premNetworking Infrastructure / load-balancer-proxy
- netscaler application delivery controllerNetwork DeviceOn-premNetworking Infrastructure / load-balancer-proxy
- netscaler gatewaySecurity ProductOn-premNetworking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact