{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/netscaler-gateway--13.1-63.18-14.1-72.61/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*","cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*","cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*","cpe:2.3:a:citrix:netscaler_application_delivery_controller:14.1-66.68:*:*:*:fips:*:*:*","cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-8452"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["NetScaler ADC (\u003c 13.1-37.272, 13.1-63.18, 14.1-72.61, 14.1-66.68)","NetScaler Gateway (\u003c 13.1-63.18, 14.1-72.61)"],"_cs_severities":["critical"],"_cs_tags":["cve-2026-8452","remote-code-execution","heap-overflow","citrix","network"],"_cs_type":"advisory","_cs_vendors":["Citrix"],"content_html":"\u003cp\u003eCVE-2026-8452 is a memory corruption vulnerability in the Citrix NetScaler AAA service. The flaw is a heap overflow that allows for unauthenticated remote code execution. The vulnerability is specifically reachable when the NetScaler appliance is configured to use SAML as either a Service Provider (SP) or an Identity Provider (IdP). A working exploit has been publicly disclosed, including a tool that deploys a webshell to the appliance.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an internet-facing Citrix NetScaler appliance configured with SAML.\u003c/li\u003e\n\u003cli\u003eAttacker sends a crafted request to the AAA service endpoint to trigger a heap overflow.\u003c/li\u003e\n\u003cli\u003eMemory corruption allows for controlled execution flow redirection.\u003c/li\u003e\n\u003cli\u003eAttacker leverages the heap overflow to execute arbitrary shellcode.\u003c/li\u003e\n\u003cli\u003eShellcode writes a PHP webshell to a predictable location (e.g., /vpn/theme/x.php).\u003c/li\u003e\n\u003cli\u003eAttacker interacts with the webshell to execute arbitrary system commands with root privileges.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to execute arbitrary code with root privileges on the affected NetScaler appliance, potentially leading to full compromise of the device and persistent access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately patch all Citrix NetScaler ADC and Gateway instances to the versions identified by the vendor as non-vulnerable: NetScaler ADC/Gateway 13.1 (\u0026gt;= 13.1-63.18) and 14.1 (\u0026gt;= 14.1-72.61).\u003c/li\u003e\n\u003cli\u003eReview network access controls to ensure the AAA service is not unnecessarily exposed to untrusted networks.\u003c/li\u003e\n\u003cli\u003eAudit the web directory paths mentioned in the exploit (e.g., /vpn/theme/) for the presence of unauthorized files or scripts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-01T10:58:14Z","date_published":"2026-11-01T10:58:14Z","id":"https://feed.craftedsignal.io/briefs/2026-11-citrix-netscaler-rce/","summary":"CVE-2026-8452 is a critical pre-authentication heap overflow in the Citrix NetScaler AAA service, reachable when SAML is configured, allowing for remote code execution via publicly available exploit code.","title":"Citrix NetScaler: AAA Service pre-authentication heap overflow (CVE-2026-8452)","url":"https://feed.craftedsignal.io/briefs/2026-11-citrix-netscaler-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - NetScaler Gateway (\u003c 13.1-63.18, 14.1-72.61)","version":"https://jsonfeed.org/version/1.1"}