CVE-2026-8451

Published Jun 30, 2026

Last updated 3 months ago

VPN

Port (53)

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-8451 is a pre-authentication memory overread vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway appliances. The vulnerability is present when the appliance is configured as a Security Assertion Markup Language (SAML) Identity Provider (IdP). It stems from insufficient input validation within NetScaler's custom XML attribute parser at the `/saml/login` endpoint. When processing a crafted SAML request containing an unquoted and unterminated XML attribute value—such as `AssertionConsumerServiceURL` or `ID`—the parser fails to recognize whitespace or newlines as terminators. Instead, it continues reading past the allocated buffer boundary until it encounters a control character like a null byte or a closing bracket. This out-of-bounds read allows a remote, unauthenticated attacker to leak fragments of the appliance's memory, which are returned in the server's response traffic, specifically within the `NSC_TASS` cookie. The leaked data can expose session tokens, credentials, or process pointers resident in the appliance. While this vulnerability leaks fewer bytes per request compared to earlier "CitrixBleed" flaws due to the control character termination, a minimal malformed request can also be used to crash the appliance, resulting in a denial of service.

Description: Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML IDP
Source: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5
NVD status: Analyzed
Products: netscaler_application_delivery_controller, netscaler_gateway

Risk scores

CVSS 4.0

Type: Secondary
Base score: 8.8
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: HIGH

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-125

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*",
            "matchCriteriaId": "D8189708-5190-45E3-BF9A-7A429E87DFE7",
            "versionEndExcluding": "13.1-37.272",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*",
            "matchCriteriaId": "D93A5760-5C50-4786-B981-24A7B35C3055",
            "versionEndExcluding": "13.1-37.272",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*",
            "matchCriteriaId": "BC139A27-D7CE-4D92-9A1F-09713C4C9546",
            "versionEndExcluding": "13.1-63.18",
            "versionStartIncluding": "13.1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*",
            "matchCriteriaId": "0108075C-1047-449C-A707-F2532770C2AD",
            "versionEndExcluding": "14.1-72.61",
            "versionStartIncluding": "14.1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:14.1-66.68:*:*:*:fips:*:*:*",
            "matchCriteriaId": "A2BC089B-97D0-4FDB-A336-74409DCDC5E3",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "962D2276-7285-41E2-A867-D464AE11677F",
            "versionEndExcluding": "13.1-63.18",
            "versionStartIncluding": "13.1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "1591FBCE-57DD-416F-A858-E898B0946AB6",
            "versionEndExcluding": "14.1-72.61",
            "versionStartIncluding": "14.1",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.