Listen to this Post
CVE-2026-8452 is a memory overflow vulnerability affecting Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. The flaw resides in the SAML authentication code path and is reachable without any credentials — an attacker only needs a NetScaler appliance configured to use SAML as either a Service Provider (SP) or an Identity Provider (IdP). During SAML signature canonicalization, vulnerable versions of the `nsppe` binary (NetScaler’s packet-processing engine) copy attacker-controlled data from the SAML message’s `ds:SignedInfo` element into a fixed-size global buffer without verifying that the data actually fits. Sending an oversized `SignedInfo` element causes the copy to run beyond the buffer boundary, corrupting adjacent packet-engine state.
The triggering mechanism identified by watchTowr researchers is the `PrefixList` attribute inside an `InclusiveNamespaces` element — a child of the `CanonicalizationMethod` block within SignedInfo. Unlike most other SAML attributes, `PrefixList` can hold an essentially arbitrary string, constrained only by a requirement that each space-separated token be unique. By populating it with thousands of uniquely numbered tokens, researchers caused the canonicalized output to overflow the fixed-size buffer and spill into the header of the adjacent memory chunk.
Because NetScaler’s `nsppe` binary is compiled without position-independent execution and without address-space layout randomization (ASLR), every function and global variable sits at a fixed, known address — eliminating the need for an information-leak primitive. The overflow is a linear write from one chunk’s data area directly into its neighbor’s metadata. The corrupted neighbor chunk contains a data pointer at offset `+0x50` that a later `memcpy` call inside `splitPktInner` uses as its destination. Because the canonicalized `PrefixList` data is also the copy source, researchers ended up controlling both the source and the destination of a `memcpy` — a clean write-what-where primitive. This primitive was then used to overwrite tx_pkt_complete_fptr, a global function pointer loaded and called unconditionally inside pe_tx_pkt, achieving full control over the instruction pointer. The NetScaler heap being executable allowed shellcode to be placed directly on the heap and executed. On a freshly spawned `nsppe` process, the `PrefixList` data consistently lands at a fixed heap address, making exploitation reliable and repeatable. Citrix assigned a CVSS v4.0 base score of 8.8 (HIGH), while the NVD lists a CVSS v3.1 score of 9.8 (CRITICAL). Public proof-of-concept exploit code was released on August 14, 2026, and open-source reporting indicates exploitation in the wild.
DailyCVE Form:
Platform: Citrix NetScaler ADC/Gateway
Version: 14.1 <72.61, 13.1 <63.18
Vulnerability: Heap Buffer Overflow (CWE-119)
Severity: HIGH (CVSS 4.0: 8.8)
date: 2026-06-30
Prediction: 2026-06-30 (already patched)
What Undercode Say:
Analytics from threat intelligence sources indicate active exploitation following PoC release. CISA KEV status: Confirmed exploited. EPSS score: 0.00487 (0.39763 percentile). Public exploit maturity: Verified. Attack vector: Network, no authentication required. Impact: High confidentiality, Low integrity, High availability. Affected configurations: Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
Detection script for CVE-2026-8452 vulnerable preconditions Source: https://github.com/derekpreston81/CVE_ADC_IOC_2026 Check for vulnerable configurations grep -E "add authentication vserver|add vpn vserver" /nsconfig/ns.conf Check current version /nscli -U -s "show version" | grep "NetScaler" Affected versions: 14.1 before 14.1-72.61 13.1 before 13.1-63.18 Example PoC execution (watchTowr detection artifact generator) python3 watchTowr-vs-Citrix-Netscaler-PreAuth-RCE.py --target https://<target-ip>:9443/
Exploit: (Educational Purposes!)
The exploit chain leverages the SAML `PrefixList` overflow:
- Craft a SAML authentication request with an oversized `PrefixList` attribute containing thousands of unique tokens.
- The `nsppe` engine copies this data into a fixed-size global buffer without bounds checking, triggering a heap overflow.
- The overflow corrupts adjacent heap metadata, specifically a data pointer at offset `+0x50` in the neighbor chunk.
- A subsequent `memcpy` in `splitPktInner` uses the corrupted pointer as its destination, giving the attacker control over both source and destination — a write-what-where primitive.
- Overwrite `tx_pkt_complete_fptr` (global function pointer) to redirect execution to attacker-controlled shellcode.
- Shellcode executes with root privileges due to executable heap memory.
Proof-of-concept command (watchTowr Labs) python3 watchTowr-vs-Citrix-Netscaler-PreAuth-RCE.py --target https://<target>:9443/ Output: webshell deployed at /vpn/theme/x.php Example: https://<target>:9443/vpn/theme/x.php?0=uname+-a;id
Protection:
- Immediate Patching: Upgrade to NetScaler ADC and NetScaler Gateway 14.1-72.61 or later, or 13.1-63.18 or later. For FIPS/NDcPP builds, upgrade to 13.1-37.272 or later.
- Configuration Review: Identify appliances configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Check for SAML SP or IdP configurations.
- Network Restriction: Until patching is complete, restrict external access to affected Gateway and AAA services, especially internet-facing deployments.
- Monitoring: Watch for abnormal `nsppe` crashes or rapid respawns, unusual SAML request sizes, oversized
SignedInfo-related fields, and unexpected server-side script artifacts. - Assume Compromise: Given public PoC and active exploitation, conduct compromise assessments on potentially vulnerable appliances.
Impact:
Successful exploitation can cause denial of service (DoS), unpredictable system behavior, and crashes in affected NetScaler appliances. Independent analysis confirms the impact is substantially more severe: under reachable SAML configurations, unauthenticated attackers can corrupt heap state in nsppe, gain control of execution flow, and execute code with root privileges in the packet-processing context. This enables full compromise of the appliance, including persistent backdoor deployment, manipulation of authentication and gateway functions, and disruption of remote access and application delivery services. Because NetScaler appliances are often deployed at the network perimeter, a successful compromise can provide adversaries with access to a critical authentication and access management component, potentially leading to lateral movement within enterprise environments.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
