CVE-2026-8452 is a memory-overflow bug (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway that triggers when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN or RDP Proxy) virtual server or as an AAA virtual server, letting a remote attacker cause unpredictable or erroneous behavior and denial of service, and it carries an NVD-confirmed Primary CVSS v3.1 score of 9.8 (critical) as well as a live CISA KEV listing.
Vulnerability summary
9.8
Critical
1.0%
EPSS score (FIRST)
Yes
CISA KEV catalog
2026-06-30
Published
Vulnerability ID: CVE-2026-8452 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Citrix NetScaler ADC | cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:*:*:*:* | 13.1 before 13.1-63.18 (fixed in 13.1-63.18); 14.1 before 14.1-72.61 (fixed in 14.1-72.61); FIPS/NDcPP builds before 13.1-37.272 (fixed in 13.1-37.272) |
| Citrix NetScaler Gateway | cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* | 13.1 before 13.1-63.18 (fixed in 13.1-63.18); 14.1 before 14.1-72.61 (fixed in 14.1-72.61) |
What this means
CVE-2026-8452 is an improper restriction of operations within the bounds of a memory buffer (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway. NVD's description states the flaw leads to "unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server" (NVD).
NVD's own analysis (source [email protected], type Primary) lists a CVSS v3.1 score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, high impact across confidentiality, integrity and availability. A separate CVSS v4.0 Secondary score of 8.8 is also on file (NVD).
NVD's configuration data lists the affected builds as: NetScaler ADC/Gateway 13.1 before 13.1-63.18, 14.1 before 14.1-72.61, and FIPS/NDcPP-certified 13.1 builds before 13.1-37.272 — all fixed in the versions above (NVD). Citrix's own knowledge-base advisory CTX696604 is the vendor's canonical source for upgrade guidance, though its content is served behind a JavaScript-rendered support portal that could not be retrieved directly for this page; readers should consult it for the latest build numbers and any interim mitigations (Citrix Knowledge Center CTX696604).
CISA added CVE-2026-8452 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-08-26, with a required-action due date of 2026-08-29 — a 3-day window reflecting the severity of an actively-exploited, unauthenticated network-facing flaw on a VPN/remote-access appliance; known ransomware-campaign use is listed as "Unknown" (catalog confirmed live this run, matched by exact cveID string against the raw KEV feed) (CISA KEV).
As of 2026-10-30, FIRST scores the probability of exploitation at 0.01011 (63.147th percentile) — modest relative to the critical CVSS score, consistent with a memory-corruption DoS rather than a directly weaponizable RCE primitive, though the appliance's role as an internet-facing SSL-VPN/remote-access gateway keeps it an attractive target (FIRST EPSS).
Any NetScaler ADC or Gateway instance below the fixed builds above, and configured as a Gateway or AAA virtual server, should be upgraded immediately; operators cannot rely on network segmentation alone given these appliances are deliberately internet-facing.
Evidence
- Memory-overflow vulnerability in NetScaler ADC/Gateway causing unpredictable behavior and denial of service when configured as a Gateway or AAA virtual server. — NVD
- NVD Primary CVSS v3.1 score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; a Secondary CVSS v4.0 score of 8.8 is also recorded. — NVD
- Affects NetScaler ADC/Gateway 13.1 before 13.1-63.18, 14.1 before 14.1-72.61, and FIPS/NDcPP 13.1 builds before 13.1-37.272. — NVD
- Added to the CISA KEV catalog on 2026-08-26, due date 2026-08-29; known ransomware-campaign use listed as Unknown. — CISA KEV
- EPSS score is 0.01011 (63.147th percentile) as of 2026-10-30. — FIRST EPSS
