Citrix NetScaler ADC and Gateway Memory Buffer Overflow
CVE-2026-8452 is a CVSS 9.8 critical memory buffer overflow in Citrix NetScaler ADC and NetScaler Gateway affecting appliances configured as Gateway or AAA virtual server, confirmed exploited in the wild and added to CISA KEV on August 26, 2026.
- Vendor
- Citrix
- Product
- NetScaler ADC and NetScaler Gateway
- CVSS
- 9.8
- EPSS (exploit probability)
- 1.0%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-8452 being exploited?
Yes. CISA added CVE-2026-8452 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.0% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
CVE-2026-8452 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
CVE-2026-8452 is a memory buffer overflow in Citrix NetScaler ADC and NetScaler Gateway. The flaw is scoped to appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. Outside those roles, the vulnerability is not directly reachable via the same attack surface.
NVD rates it CVSS 9.8 critical. The described impact is unpredictable or erroneous behavior and denial of service. CISA added it to the Known Exploited Vulnerabilities catalog on August 26, 2026, confirming active exploitation in the wild.
Federal patch deadline: August 29, 2026, per BOD 26-04. CISA has also attached forensics triage requirements to this entry.
What to do: Apply mitigations per Citrix advisory CTX696604. For cloud-deployed NetScaler, follow BOD 26-04 cloud guidance, or discontinue use if mitigations are unavailable.
Full coverage: Patch by Friday: Citrix NetScaler CVE-2026-8452 in KEV.
Other Citrix NetScaler ADC and NetScaler Gateway CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-107406 Memory overflow in Citrix NetScaler ADC and Gateway SAML handlingwrite-up | [ CRITICAL ] | 9.5 | 0.5% | — |
| CVE-2026-88779 Citrix NetScaler Memory Buffer Flaw Enables Denial-of-Service Attackswrite-up | [ HIGH ] | 7.5 | 0.6% | |
| CVE-2026-88772 Citrix NetScaler ADC/Gateway RCE via Memory Buffer Mishandlingwrite-up | [ HIGH ] | — | 1.3% | |
| CVE-2026-88771 Citrix NetScaler ADC/Gateway Unauthenticated RCE via Input Validation Flawwrite-up | [ HIGH ] | — | 1.1% | |
| CVE-2026-19490 Critical authentication bypass in Citrix NetScaler ADC and Gatewaywrite-up | [ CRITICAL ] | 9.3 | 23.2% | |
| CVE-2025-5777 Citrix Bleed 2 — NetScaler ADC/Gateway memory-disclosure leaking session tokensransomware usewrite-up | [ HIGH ] | 7.5 | 100.0% | |
| CVE-2025-6543 Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability | [ CRITICAL ] | 9.8 | 10.6% | |
| CVE-2023-6549 Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability | [ HIGH ] | 8.2 | 57.6% |
