Researchers have published the first detailed walk through of a remote code execution bug in Citrix NetScaler in three years, showing how an attacker who has never logged in can take control of the appliance guarding a company's remote access.
The analysis comes from watchTowr Labs, where Sina Kheirkhah (@SinSinology) reverse engineered a recent NetScaler ADC and NetScaler Gateway security bulletin to work out what Citrix had fixed. watchTowr believes the flaw is CVE-2026-8452, which Citrix describes as a memory overflow, but is explicit that it cannot confirm the match, because Citrix does not map individual CVEs to the researchers credited in its advisory. Treat that identifier as the researchers' best inference rather than an established fact.
What's affected
Citrix lists NetScaler ADC and NetScaler Gateway 14.1 before 14.1-72.61 and 13.1 before 13.1-63.18 as affected. Based on watchTowr's testing, the bug is only reachable when the appliance is configured to use SAML, the single sign on standard, either as a service provider or as an identity provider. NetScaler sits at the front door of remote access for a large share of big enterprises, which is what makes a pre-authentication flaw on it serious: there is no password to guess and no account to compromise first.
How the attack works
When NetScaler receives a signed SAML message it has to check the signature, and before it can do that it rewrites part of the message into a standard tidied form, a step called canonicalization. That cleaned up text gets copied into a buffer of fixed size, and in the vulnerable builds nothing checks whether it actually fits.
watchTowr found one field an attacker can make arbitrarily large: PrefixList, a list of namespace prefixes inside the SignedInfo block, which accepts almost any string so long as each space separated entry is unique. Sending an oversized list runs the copy off the end of its buffer and straight into the header of the neighboring network buffer chunk, overwriting a data pointer that the packet engine later trusts. A subsequent copy then reads from attacker supplied data and writes to an attacker chosen address, the classic write what where primitive.
From there, the researchers note, the packet engine binary is not position independent and there is no address space randomization, so every function sits at a fixed, known address and no memory leak is needed first. They used the write primitive to overwrite a function pointer the transmit path calls regularly, and took control of execution. The patched builds add explicit size checks around the copies.
What you should do
Upgrade to 14.1-72.61 or 13.1-63.18 or later. The research reports no exploitation in the wild, but NetScaler has a long history of flaws being weaponized quickly once details are public, and an access broker used a Citrix bug to plant DragonForce ransomware earlier this year. Organizations that cannot patch at once should check whether SAML authentication is configured on the appliance, since that is the precondition for reaching this code path. It is also the second SAML handling flaw to surface in NetScaler this summer, after a memory disclosure bug in the same area in June.
watchTowr's full technical analysis includes the crash traces and the heap layout work behind the exploit.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.