---
title: "NetScaler CVE-2026-8452: DoS Bug Exploited as Pre-Auth RCE"
url: https://erroneo.us/security/briefs/netscaler-gateway-saml-rce-cve-2026-8452/
description: "Billed as DoS, this NetScaler Gateway/AAA memory bug gives unauthenticated RCE and is exploited. Fixed in 14.1-72.61 and 13.1-63.18. Patch if you have not."
type: security-brief
section: "Security Digest"
date_published: 2026-06-30
date_modified: 2026-08-26
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-8452"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# NetScaler CVE-2026-8452: DoS Bug Exploited as Pre-Auth RCE

**Verdict: Act now.** Any NetScaler configured as a Gateway or AAA server that is still below the June 30 builds needs patching today and a check for web shells; the bug the vendor called DoS is a public pre-auth RCE under attack.

- **Who must act:** Owners of customer-managed NetScaler ADC or Gateway appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, or using SAML, on builds older than 14.1-72.61 or 13.1-63.18.
- **Who can relax:** Appliances already on 14.1-72.61, 13.1-63.18, 13.1-37.272 FIPS/NDcPP or later (including the September 2026 builds), appliances used only for load balancing, and Citrix-managed cloud services.
- **Affected:** NetScaler ADC and Gateway 14.1 before 14.1-72.61; NetScaler ADC and Gateway 13.1 before 13.1-63.18; NetScaler ADC 14.1 FIPS before 14.1-72.61 FIPS; NetScaler ADC 13.1 FIPS and NDcPP before 13.1-37.272; Secure Private Access hybrid deployments using affected NetScaler instances
- **Fixed:** 14.1-72.61 and later; 13.1-63.18 and later; 14.1-72.61 FIPS and later; 13.1-37.272 FIPS/NDcPP and later
- **CVEs:** CVE-2026-8452
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Run show ns version on every NetScaler and list those configured as Gateway or AAA (add vpn vserver / add authentication vserver in ns.conf).
2. Upgrade to 14.1-72.61, 13.1-63.18 or 13.1-37.272 FIPS/NDcPP or later; the September 2026 builds 14.1-73.41 and 13.1-64.28 also fix CVE-2026-88771/88772.
3. Move any appliance on a release line the bulletin does not list to a supported, fixed build.
4. Hunt for web shells on every Gateway or AAA appliance that was unpatched after August 14; upgrading does not remove them.
5. If you find compromise, rebuild from a clean image and rotate the appliance's passwords, certificates, keys and stored LDAP or RADIUS secrets.

### How to check if you are affected

- Search the appliance for recently created PHP files, such as the x.php and z.php web shells Previdian reported (for example find /var -name '*.php' -mtime -90).
- Check whether /bin/sh has the SUID bit set (ls -l /bin/sh), the trick watchTowr used to get root from its web shell.
- Look for nsppe crash dumps in /var/core and unexplained packet engine restarts or reboots since mid-August.
- Review web and shell activity for discovery commands such as id and echo run as the nobody user.

## What happened

On June 30, 2026, Cloud Software Group published [security bulletin CTX696604](https://support.citrix.com/external/article/CTX696604), which fixes six NetScaler ADC and Gateway CVEs. One of them, CVE-2026-8452, was described as a "memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service" on appliances configured as a Gateway or AAA virtual server, scored CVSS 4.0 8.8. Citrix said it found the issue internally and had not seen exploitation at the time ([Help Net Security](https://www.helpnetsecurity.com/2026/08/27/netscaler-adc-gateway-cve-2026-8452/)).

On August 14, [watchTowr Labs](https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452/) showed it is much worse. Analyzing the patch, the researchers found a heap overflow in `nsppe`, NetScaler's packet engine, during SAML signature canonicalization. The `PrefixList` attribute inside a SAML message's `ds:SignedInfo` is copied into a fixed-size global buffer without a size check. watchTowr turned that into unauthenticated code execution. `nsppe` runs as root, so the attacker controls the appliance. The write-up hedges that it believes the bug is CVE-2026-8452; the vendor has not confirmed the mapping.

Attacks followed. Previdian (formerly KEVIntel) and Defused reported in-the-wild exploitation shortly after the write-up. Previdian saw web shells named `x.php` and `z.php`, discovery commands such as `id` and `echo`, and three source IPs from three countries ([SecurityWeek](https://www.securityweek.com/recent-citrix-netscaler-vulnerability-exploited-in-the-wild/), Help Net Security). CISA added the CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8452) on August 26 with an August 29 deadline. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-8452) rates it CVSS 3.1 9.8. As of October 21, the bulletin's changelog shows no update acknowledging exploitation or code execution.

## Who is affected

The affected versions are customer-managed NetScaler ADC and Gateway 14.1 before 14.1-72.61, 13.1 before 13.1-63.18, 14.1 FIPS before 14.1-72.61 FIPS, and 13.1 FIPS/NDcPP before 13.1-37.272. Secure Private Access hybrid deployments that use these appliances are included ([CVE record](https://www.cve.org/CVERecord?id=CVE-2026-8452), bulletin). Citrix patches its own managed cloud services.

Citrix's precondition is an appliance configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. watchTowr frames it as NetScaler acting as a SAML service provider or identity provider. In practice both describe the authentication-facing roles that sit on the internet. An appliance used purely as a load balancer is not affected, according to Citrix.

## Do you really need to act?

If you have a Gateway or AAA NetScaler below the June 30 builds, yes, today. The bug is pre-authentication, the technique is public, exploitation is confirmed, and NetScaler Gateway is one of the most attacked edge products. Root on a VPN gateway exposes session traffic, credentials and the internal network behind it.

Many fleets are already covered. The fix has been out since June 30, and the later September builds (14.1-73.41, 13.1-64.28) for CVE-2026-88771/88772 include it. The same bulletin also fixed CVE-2026-8451, a memory overread on SAML IdP configurations, which SecurityWeek reports was also exploited. It is not in KEV as of October 21. If you are on a current build and found nothing when you checked for the September bugs, run the hunt below once and move on.

## What to do now

1. Inventory. On each appliance, run `show ns version`. From the shell, run `grep -E 'add (vpn|authentication) vserver' /nsconfig/ns.conf` to see whether it meets the precondition, which is the check the bulletin describes.
2. Upgrade to 14.1-72.61, 13.1-63.18 or 13.1-37.272 (FIPS/NDcPP) or later. Prefer the latest build on your line, which also covers the September CVEs.
3. Appliances on release lines the bulletin does not list get no fix, so move them to a supported, patched build.
4. Hunt on any Gateway or AAA appliance that was unpatched after August 14. Upgrading does not remove a web shell that is already there.
5. If you find compromise, rebuild from a clean image rather than cleaning in place. Rotate admin passwords, TLS keys and certificates, and the LDAP or RADIUS bind credentials stored on the appliance.

## How to tell if you were hit

No official indicators have been published. From the reports: look for PHP files you did not deploy, especially `x.php` and `z.php` (`find /var -name '*.php' -mtime -90 -ls` is a starting point). watchTowr's exploit set the SUID bit on `/bin/sh` so its web shell, which runs as `nobody`, could act as root. Check `ls -l /bin/sh` for an `s` in the permissions. Failed attempts crash `nsppe`, which can trigger a reboot, so unexplained crash dumps (NetScaler [stores them](https://docs.netscaler.com/us/en/citrix-adc/13-1/system/troubleshooting-citrix-adc/how-to-download-core-or-crashed-files-from-citrix-.html) under `/var/core`, e.g. `/var/core/1`) or reboots since mid-August are worth investigating. The patched code adds a "SAML signature validation failed: SignedInfo size ... is too large" message. watchTowr does not say whether it is logged by default, so treat it as a hint, not a detection. Any confirmed hit means a rebuild and full credential rotation.

## Timeline

- Jun 30, 2026 — Citrix publishes CTX696604 and fixed builds, describing CVE-2026-8452 as a denial-of-service bug.
- Aug 14, 2026 — watchTowr publishes its analysis showing pre-authentication RCE.
- Aug 26, 2026 — CISA adds CVE-2026-8452 to KEV, with a federal deadline of August 29.
- Aug 27, 2026 — SecurityWeek and Help Net Security report exploitation by Previdian and Defused.

## Sources

1. [NetScaler (Cloud Software Group) — CTX696604: Security Bulletin for CVE-2026-8451, CVE-2026-8452 and others](https://support.citrix.com/external/article/CTX696604)
2. [watchTowr Labs — You're back in the room: Citrix NetScaler pre-auth RCE (CVE-2026-8452)](https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452/)
3. [CVE record — CVE-2026-8452](https://www.cve.org/CVERecord?id=CVE-2026-8452)
4. [NVD — CVE-2026-8452](https://nvd.nist.gov/vuln/detail/CVE-2026-8452)
5. [CISA — Known Exploited Vulnerabilities: CVE-2026-8452](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-8452)
6. [NetScaler docs — Download core or crash files from NetScaler appliance](https://docs.netscaler.com/us/en/citrix-adc/13-1/system/troubleshooting-citrix-adc/how-to-download-core-or-crashed-files-from-citrix-.html)
7. [SecurityWeek — Recent Citrix NetScaler vulnerability exploited in the wild](https://www.securityweek.com/recent-citrix-netscaler-vulnerability-exploited-in-the-wild/)
8. [Help Net Security — Previously patched Citrix NetScaler flaw exploited in the wild (CVE-2026-8452)](https://www.helpnetsecurity.com/2026/08/27/netscaler-adc-gateway-cve-2026-8452/)

---
Source page: https://erroneo.us/security/briefs/netscaler-gateway-saml-rce-cve-2026-8452/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt