Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2026-8452

HighExploitedPublic exploit

Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server

Published Jun 30, 2026 · Updated Aug 27, 2026

Key Facts

Patch immediately
  • CVE-2026-8452 is a high-severity vulnerability (CVSS 8.8 v4) affecting Netscaler Application Delivery Controller (Citrix), Netscaler Gateway (Citrix).
  • It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Aug 17, 2026. Public exploit code is available.
  • EPSS estimates a 1.0% probability of exploitation in the next 30 days.
  • Fixed versions are available, including Netscaler Application Delivery Controller 37.272, Netscaler Application Delivery Controller 63.18, Netscaler Application Delivery Controller 72.61.
  • Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v4

8.8

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L

EPSS (30-day exploit likelihood)

1.0%

Higher than 62.5% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2026-8452 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server

Known-Exploited Catalog Listings

CatalogAddedRemediation dueRansomware use
CISA KEVAug 26, 2026Aug 29, 2026Not reported
Industry KEV feedAug 17, 2026Aug 29, 2026Not reported
CIRCL KEVAug 17, 2026Aug 29, 2026Not reported
ENISA EUVDAug 26, 2026n/aNot reported

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Products

7 affected entries in total
ProductAffected versionsFixed in
Netscaler Application Delivery ControllerCitrix14.1-66.68, >= 14.113.1-63.18
Netscaler GatewayCitrix>= 14.113.1-63.18

Patched Releases

Netscaler Application Delivery Controller

37.272, 63.18, 72.61, 13.1-37.272, 13.1-63.18, 14.1-72.61

Netscaler Gateway

13.1-63.18, 14.1-72.61, 63.18, 72.61

Timeline

  1. Publicly disclosed

    Jun 30, 2026

  2. Added to Industry KEV feed

    Aug 17, 2026

  3. Added to CIRCL KEV

    Aug 17, 2026

  4. Added to CISA KEV

    Aug 26, 2026

  5. Added to ENISA EUVD

    Aug 26, 2026

  6. Last updated

    Aug 27, 2026

Weakness Type

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

3 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2026-8452 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo