Citrix NetScaler Memory Overread Exploit Active (CVE-2026-8451) | MSSP Advisory

Risk Assessment

Citrix has patched CVE-2026-8451, a memory overread vulnerability in NetScaler ADC and NetScaler Gateway appliances that allows unauthenticated attackers to send malformed requests and leak protected process memory data. The flaw requires the appliance to be configured as a SAML Identity Provider, a configuration that is not uncommon, and active exploitation attempts were observed on honeypot sensors within 24 hours of the patch release. The same patch cycle also addresses two high-severity memory overflow vulnerabilities (CVE-2026-8452 and CVE-2026-8655) that attackers can chain with the memory leak to bypass ASLR and achieve full device compromise.

If you or any of your clients are running NetScaler ADC or NetScaler Gateway as a SAML IdP, those appliances are being actively probed right now, and an unpatched device sitting in front of a client network is your liability, not just theirs. The chaining risk is the part that should keep you up tonight: the memory leak alone may not hand attackers credentials, but paired with the overflow CVEs in the same patch batch, it becomes a path to full device takeover and everything behind it. If a client gets hit through a NetScaler you manage and you had not communicated this patch, that is a retention conversation you do not want to have.