{"id":"citrix-netscaler-memory-overflow-attacks-aug-2026","category":"patch","status":"closed","title":"Citrix NetScaler ADC and Gateway memory overflow CVE-2026-8452 exploited; fixes available","tldr":"Attackers are exploiting CVE-2026-8452 in customer-managed Citrix NetScaler gateways and authentication servers. Citrix describes crashes; NHS England also reports demonstrated code execution. Ask your IT provider to install the fixed firmware.","summary":"CVE-2026-8452 is a memory overflow in customer-managed Citrix NetScaler ADC and NetScaler Gateway appliances configured as gateways or AAA authentication servers. Citrix describes disruption and denial of service; NHS England says researchers also demonstrated remote code execution. Citrix disclosed the flaw on 30 June with fixed firmware. NHS England reported attack attempts by 17 August, and CISA listed it as exploited on 26 August. This affects organisations providing remote access and authentication, including workplaces used by executives and family offices. As of 3 November, fixes cover every affected supported branch. NetScaler 13.0 is unsupported and needs upgrading to a supported release. The reviewed sources do not establish the number of victims or whether attacks have stopped.","action":"Ask your workplace or family office IT provider to update NetScaler to 14.1-72.61 or 13.1-63.18, or later supported builds. FIPS deployments need 14.1-72.61 FIPS; 13.1 FIPS/NDcPP deployments need 13.1-37.272 or later. If you only use your employer's remote access service, its administrator must apply this fix.","product":"Citrix NetScaler ADC and NetScaler Gateway","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-8452"],"tags":["citrix","netscaler","vpn","memory-overflow","denial-of-service","actively-exploited"],"affected":["NetScaler ADC and NetScaler Gateway 14.1 before 14.1-72.61","NetScaler ADC and NetScaler Gateway 13.1 before 13.1-63.18","NetScaler ADC FIPS before 14.1-72.61 FIPS","NetScaler ADC FIPS and NDcPP before 13.1-37.272"],"fixed":["NetScaler ADC and NetScaler Gateway 14.1-72.61 and later releases","NetScaler ADC and NetScaler Gateway 13.1-63.18 and later releases of 13.1","NetScaler ADC 14.1-FIPS 14.1-72.61 FIPS and later releases of 14.1-FIPS","NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.272 and later releases of 13.1-FIPS and 13.1-NDcPP"],"matches":[],"sources":[{"kind":"advisory","title":"NetScaler ADC and NetScaler Gateway Security Bulletin CTX696604","url":"https://support.citrix.com/external/article/ctx696604/netscaler-adc-and-netscaler-gateway-secu.html","by":"Citrix","date":"2026-06-30"},{"kind":"advisory","title":"Active Exploitation of Citrix NetScaler ADC and NetScaler Gateway Vulnerability (CVE-2026-8452)","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4832","by":"NHS England","date":"2026-08-17"},{"kind":"advisory","title":"Citrix security advisory (AV26-645) – Update 3","url":"https://www.cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-645","by":"Canadian Centre for Cyber Security","date":"2026-08-26"}],"started":"2026-08-26","closed":"2026-08-26","created":"2026-11-03T22:15:19.798Z","updated":"2026-11-03T22:15:19.798Z","cve_notes":[{"cve":"CVE-2026-8452","name":"Memory overflow in NetScaler gateways and AAA servers","what":"A memory overflow in NetScaler ADC and Gateway, when configured as a gateway or AAA authentication server, lets an unauthenticated network attacker cause erratic operation or stop the service, according to Citrix.","severity":"high","cvss":8.8}],"timeline":[{"at":"2026-08-26","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-8452 to its Known Exploited Vulnerabilities catalogue, Canada's Cyber Centre confirmed.","url":"https://www.cyber.gc.ca/en/alerts-advisories/citrix-security-advisory-av26-645","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-08-17","added":"2026-11-03T22:11:23.504Z","kind":"wider-attacks","text":"NHS England raised its alert to High following reports of active exploitation. It reported attack attempts against honeypots, systems used to observe attackers.","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4832","by":"NHS England","patch":null},{"at":"2026-08-14","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"NHS England warned that researchers had demonstrated remote code execution, beyond the denial of service described by Citrix.","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4832","by":"NHS England","patch":null},{"at":"2026-06-30","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Citrix published advisory CTX696604, including CVE-2026-8452, with fixed builds for all affected supported branches.","url":"https://support.citrix.com/external/article/ctx696604/netscaler-adc-and-netscaler-gateway-secu.html","by":"Citrix","patch":"patched"}],"url":"https://hard.fyi/live/citrix-netscaler-memory-overflow-attacks-aug-2026/","json":"https://hard.fyi/api/live?id=citrix-netscaler-memory-overflow-attacks-aug-2026"}