Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-8452 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Year | 2026 |
| Publication Date | 2026-08-26 |
| Vendor | Citrix |
| Product | NetScaler ADC and NetScaler Gateway |
| CVSS Score | 9.8 (Critical) |
| EPSS Score | 1.0% (percentile: 62%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Due Date | 2026-08-29 |
Vulnerability Description
Source: CISA KEV / NVD
Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer. The resulting overflow causes unpredictable or erroneous appliance behaviour and, ultimately, denial of service.
The flaw applies when the appliance is configured as a Gateway — SSL VPN, ICA Proxy, CVPN or RDP Proxy — or as an AAA virtual server. These are the standard NetScaler roles in a remote-access architecture, so vulnerable configurations are typically internet-facing.
CISA added this vulnerability to the Known Exploited Vulnerabilities catalog, meaning exploitation in real-world attacks has been confirmed.
Required Actions
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 “Prioritizing Security Updates Based on Risk” guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA’s deadline for US federal agencies: 2026-08-29. It is not legally binding outside that scope, but it sets a reasonable sense of urgency.
Who Is Affected?
The vulnerability affects NetScaler ADC and NetScaler Gateway appliances from Citrix configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server.
NetScaler is widely deployed as a remote-access entry point in banking, insurance, large manufacturing and public administration — usually directly on the internet edge. If your organisation publishes remote access through NetScaler, check the firmware version and patching schedule first.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
