Citrix NetScaler: AAA Service pre-authentication heap overflow (CVE-2026-8452)

CVE-2026-8452 is a memory corruption vulnerability in the Citrix NetScaler AAA service. The flaw is a heap overflow that allows for unauthenticated remote code execution. The vulnerability is specifically reachable when the NetScaler appliance is configured to use SAML as either a Service Provider (SP) or an Identity Provider (IdP). A working exploit has been publicly disclosed, including a tool that deploys a webshell to the appliance.

Attack Chain

1. Attacker identifies an internet-facing Citrix NetScaler appliance configured with SAML.
2. Attacker sends a crafted request to the AAA service endpoint to trigger a heap overflow.
3. Memory corruption allows for controlled execution flow redirection.
4. Attacker leverages the heap overflow to execute arbitrary shellcode.
5. Shellcode writes a PHP webshell to a predictable location (e.g., /vpn/theme/x.php).
6. Attacker interacts with the webshell to execute arbitrary system commands with root privileges.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary code with root privileges on the affected NetScaler appliance, potentially leading to full compromise of the device and persistent access.

Recommendation

• Immediately patch all Citrix NetScaler ADC and Gateway instances to the versions identified by the vendor as non-vulnerable: NetScaler ADC/Gateway 13.1 (>= 13.1-63.18) and 14.1 (>= 14.1-72.61).
• Review network access controls to ensure the AAA service is not unnecessarily exposed to untrusted networks.
• Audit the web directory paths mentioned in the exploit (e.g., /vpn/theme/) for the presence of unauthorized files or scripts.