CVE-2026-8451: Citrix NetScaler SAML Memory Overread

Summary

Within 24 hours of Citrix publishing advisory CTX696604 and watchTowr Labs releasing a Detection Artifact Generator for CVE-2026-8451, the Lupovis sensor network detected a coordinated scanning campaign. The campaign targeted Citrix NetScaler appliances configured as SAML Identity Providers.

A single source IP (146.70.139.154) swept across three separate Lupovis sensor deployments in a five hour window and delivered a confirmed CVE-2026-8451 exploitation payload. At the time of writing this activity is not reflected in the CISA KEV catalogue.

Key facts

• Severity: High (CVSS 8.8)
• Unauthenticated, with no credentials required
• Requires NetScaler to be configured as a SAML IdP (non-default)
• Affected: NetScaler ADC and Gateway 14.1 before 14.1-72.61; 13.1 before 13.1-63.18
• Disclosed: 30 June 2026 (CTX696604)
• PoC: watchTowr Detection Artifact Generator published the same day

Background

CVE-2026-8451 is the latest in the CitrixBleed class of memory disclosure vulnerabilities. This is a recurring pattern of memory management failures in Citrix NetScaler appliances, first identified in CVE-2023-4966 and rediscovered across successive CVEs including CVE-2025-5777, CVE-2025-12101 and CVE-2026-3055.

The vulnerability sits in the custom XML parser NetScaler uses to handle SAML AuthnRequest documents. The parser fails to terminate unquoted XML attribute values correctly when they are followed by a newline character, which causes it to read past the buffer boundary. Arbitrary memory content is then returned to the attacker in the NSC_TASS cookie in the HTTP response.

What we observed

All of the activity came from one source address, 146.70.139.154, an M247 Europe exit node in Germany (AS9009). The requests carried a python-requests/2.32.5 user agent, which points to scripted tooling. Over roughly five hours the same source worked through three separate Lupovis sensor deployments.

The order of events across those three sensors shows how the tooling makes its decisions. Each sensor first received a probe to check whether a SAML IdP endpoint was present. The two sensors that answered 404 received nothing further, while the sensor that answered 200 was sent the full CVE-2026-8451 SAMLRequest straight away in a POST to /saml/login.

The structure of that request matches the Detection Artifact Generator watchTowr published on 30 June. We are therefore confident this was the specific CVE-2026-8451 payload, and generic SAML probing can be ruled out.

The indicators we recorded were:

• Source IP: 146.70.139.154, M247 Europe SRL (AS9009), Germany
• User agent: python-requests/2.32.5
• Endpoint: POST /saml/login

Why it matters

The gap between public disclosure and a working payload arriving at our sensors was under 24 hours. Tooling released to help defenders detect the flaw was adapted for offensive scanning within the same day.

The source also validated each target before sending the payload. Monitoring that only looks for the exploit request will miss the probe that comes first, and that probe is the earlier warning that an appliance has been shortlisted.

At the time of writing CVE-2026-8451 is not listed in the CISA KEV catalogue. Teams that wait for a KEV listing before prioritising a patch would have had no prompt to act on this one.

What to do next

Check whether any NetScaler ADC or Gateway in your estate is configured as a SAML IdP, then upgrade to 14.1-72.61 or 13.1-63.18 or later. Review logs back to 30 June for requests to /saml/login from unfamiliar sources. Because the flaw leaks memory, it is worth ending active sessions once the patch is in place.

References

• Citrix security bulletin CTX696604
• watchTowr Labs analysis: https://labs.watchtowr.com/citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451/
• watchTowr Detection Artifact Generator: https://github.com/watchtowrlabs/watchTowr-vs-Netscaler-CVE-2026-8451

‍

Lupovis publishes observed exploitation activity every week in the Weekly Threat Landscape Brief. Subscribe on LinkedIn to receive it.