Citrix NetScaler ADC and Gateway Memory Overflow Vulnerability (CVE-2026-8452) Critical Security Advisory

1. Apply Official Security Patches

Immediately upgrade your NetScaler ADC and Gateway appliances to the patched versions recommended in the Citrix security bulletin.

• Refer to Citrix Advisory CTX696604 for detailed version-specific download links.

2. Temporary Mitigations (If patching cannot be immediately performed)

A. Identify and Disable Vulnerable Virtual Servers

Audit your NetScaler configuration to identify active Gateway or AAA virtual servers and disable any non-critical instances.

# Check virtual server status via NetScaler CLI
show vpn vserver
show aaa vserver

# Disable a specific virtual server
disable vpn vserver <vserver_name>
disable aaa vserver <vserver_name>

B. Restrict Network Access via ACLs

Limit access to the Gateway and AAA virtual servers (typically on TCP port 443) to trusted source IP addresses only using firewall rules or NetScaler ACLs.

# Example ACL to restrict access
add ns acl rule_block_untrusted DENY -srcIP 0.0.0.0-255.255.255.255 -destPort 443
apply ns acls

CVE-2026-8452 is a critical memory buffer overflow vulnerability (CWE-119) residing in Citrix NetScaler ADC and Gateway.

The vulnerability is exposed when the appliance is configured to handle Gateway services (such as SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or AAA virtual servers. An unauthenticated remote attacker can exploit this flaw by sending crafted network traffic to the vulnerable endpoints. Due to insufficient bounds checking, this traffic triggers a memory overflow, resulting in system instability, Denial of Service (DoS), or arbitrary code execution under system privileges.

This vulnerability is actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, with an EPSS score of 0.94, indicating an extremely high risk of exploitation.