click the screen · press Enter
Inside//UnixSingh
← back to blog
Threats & Exploits · Topic 1

CVE-2026-8451: NetScaler CitrixBleed Pre-Auth Memory Overread

By UnixSingh·8 Jul 2026·8 min readCVSS 8.8 · HIGH
CVE-2026-8451 NetScaler CitrixBleed pre-auth memory overread - Threats and Exploits

I have a soft spot for bugs that come from someone deciding to write their own parser. This is one of those. NetScaler has been bleeding memory in various creative ways for years now, and the newest entry, CVE-2026-8451, is almost funny in how it happens: the appliance forgets that a newline should end an XML attribute, keeps reading, and posts you back whatever was sitting in memory next door. No login. No clever chain. Just a malformed SAML request and a cookie full of things you were never meant to see.

watchTowr called their write-up "CitrixBleed To Infinity And Beyond", which tells you how many of these we have now had. I wanted to understand this one properly rather than just nod at the headline, so here is my read on it.

What it is

CVE-2026-8451 is a pre-authentication memory overread in Citrix NetScaler ADC and NetScaler Gateway when the appliance is configured as a SAML identity provider (IdP). Citrix describes it plainly in bulletin CTX696604 as "insufficient input validation leading to memory overread" and rates it CVSS 8.8. It was reported by Aliz Hammond of watchTowr back in March 2026 and disclosed alongside the patch on 30 June.

The affected versions, straight from Citrix's advisory:

Affected & fixed builds · CTX696604
ProductAffectedFixed
NetScaler ADC & Gateway 14.1before 14.1-72.6114.1-72.61
NetScaler ADC & Gateway 13.1before 13.1-63.1813.1-63.18
NetScaler ADC 14.1-FIPSbefore 14.1-72.61 FIPS14.1-72.61 FIPS
NetScaler ADC 13.1-FIPS / 13.1-NDcPPbefore 13.1-37.27213.1-37.272
The one precondition that matters is the SAML IdP role. Everything else is standard patch hygiene.

The one precondition that matters: this only bites if the box is acting as a SAML IdP. If you do not use that feature, this particular CVE is not your problem (though five other NetScaler bugs shipped in the same bulletin, so still patch).

Where it sits

"CitrixBleed" stopped being one CVE a while ago. It is now shorthand for a whole family of NetScaler memory-disclosure bugs, from the original CVE-2023-4966, through CVE-2025-5777 (CitrixBleed 2), to CVE-2026-3055 earlier this year. CVE-2026-8451 is the newest cousin, and it shares the March bug's root cause.

Why it matters

  • Reach. NetScaler Gateway is the front door for remote access at a huge number of enterprises. When one of these leaks, it tends to leak at scale, and the CitrixBleed lineage already has a long history of feeding ransomware crews.
  • No auth needed. The vulnerable code sits on /saml/login, which is reachable before you have logged into anything. That is the worst place for a memory bug to live.
  • What leaks is the point. Process memory on an auth appliance is exactly where session material, tokens and other secrets hang around. Even a few bytes at a time adds up if an attacker is patient.
  • It also crashes. The same parsing weakness gives a trivial denial of service. One short request can take the packet-processing engine down.

Root cause

NetScaler parses the SAML AuthnRequest XML with what looks like a hand-rolled attribute parser rather than a well-tested library. That is where it goes wrong. The parser handles quoted attribute values one way and unquoted values another, and the unquoted path is the buggy one.

For a normal attribute like id="22", the closing quote ends the value. Fine. But for an unquoted value, the parser does not treat whitespace the same way. In the unquoted path it only stops reading when it hits a null byte, a closing >, or the matching quote. A newline does not count as a terminator. So if you end an unquoted attribute with a newline instead of a space, the parser sails straight past it and keeps consuming bytes.

On top of that, the parser is far too relaxed about structure. It will accept a < as the terminator for a start tag, and it tolerates elements being nested or ordered in ways no real XML parser would allow. Chain those quirks together and you can steer the reader off the end of the request buffer and into adjacent process memory. Whatever it scoops up gets base64-encoded into the NSC_TASS cookie in the 302 response, and that comes straight back to you.

Every attribute value in this parser is a race between "did we find the terminator" and "did we run out of buffer", and the unquoted path quietly removed one of the finish lines.
One honest caveat Credit to watchTowr for spotting it: unlike CVE-2026-3055, which could leak kilobytes, this overread stops the moment it reads certain control characters such as a null byte or a >. So you get a few bytes per request, not a firehose. Still, watchTowr's testing pulled back what looked like a live pointer, and a reliable info-leak primitive sitting next to a memory-corruption bug is the classic setup for something much worse.

Exploitation path

Keeping this at the level a defender needs to recognise it, and no further. The shape of the attack is: reach the pre-auth SAML endpoint, send a SAML request whose attribute values are deliberately un-terminated, and read the leaked bytes back out of the response cookie.

The overread, in three moves
01
Reach

Hit the pre-auth /saml/login endpoint. No session needed.

▸
02
Malform

Send an AuthnRequest with an unquoted, newline-terminated attribute.

▸
03
Read

Decode the NSC_TASS cookie in the 302 reply. The tail is leaked memory.

A defensive sketch only. The exact malformed payload is deliberately left out.
POST /saml/login HTTP/1.1
Host: netscaler.example.com
Content-Type: application/x-www-form-urlencoded

SAMLRequest=<base64 of a malformed AuthnRequest with an
             unquoted, newline-terminated attribute value>

# The appliance answers 302 and sets NSC_TASS=<base64>.
# base64-decode that cookie and the tail contains bytes
# that were never part of your request.

The denial-of-service variant is even shorter. A request whose AuthnRequest tag carries a dangling attribute (nothing after the =) reliably crashes the nsppe process. I am deliberately not reproducing the exact crashing payload here.

Scope note This is a defensive walk-through, not a kit. watchTowr has published a Detection Artefact Generator on GitHub so teams can safely check their own exposure. Use that against boxes you own, and nothing you do not.

Detection & hunting

The leak itself is quiet, because the stolen bytes ride out in a cookie that looks structurally normal. So hunt the malformed requests and the appliance's reaction to them, not the payload.

  • Request signals. Look for POSTs to /saml/login where the decoded SAMLRequest is malformed: attribute values with no closing quote, newlines mid-attribute, or an AuthnRequest start tag that is never closed with >. Real SAML clients do not do this.
  • Volume and pattern. A single attacker will usually send many near-identical requests with tiny length changes to nudge the overread along. Repeated /saml/login hits from one source with varying content-length are worth a look.
  • Host telemetry. Watch for nsppe crashes or restarts and any core dumps on the appliance. The DoS variant is loud on the host even when the leak is not.
  • Baseline it. If you know which sources legitimately start SAML flows, everything else hitting that endpoint pre-auth is suspicious by default.

Remediation

  • Patch. Upgrade to NetScaler ADC/Gateway 14.1-72.61, 13.1-63.18, or the matching FIPS/NDcPP builds. That is the fix, full stop.
  • Reduce surface. If the appliance does not need to be a SAML IdP, do not run it as one. No IdP config, no CVE-2026-8451.
  • Assume-leak hygiene. If the box was internet-facing and unpatched, treat session secrets and tokens as potentially exposed. Rotate what you sensibly can and review active sessions, the same drill CitrixBleed taught us.
  • Patch the rest of the bulletin. CTX696604 covers six issues, including an unauthenticated file read and several DoS bugs. The upgrade closes those too.
Defender checklist Inventory NetScaler estate → flag SAML IdP boxes → patch to fixed builds → hunt malformed /saml/login and nsppe crashes → rotate secrets if exposure is plausible.

MITRE ATT&CK mapping

  • T1190 · Exploit Public-Facing Application (the pre-auth /saml/login endpoint).
  • T1212 · Exploitation for Credential Access (leaking secrets out of appliance memory).
  • T1539 · Steal Web Session Cookie (session material is exactly the kind of thing that lands in the leak).
  • T1499 · Endpoint Denial of Service (the nsppe crash variant).
One honest note on exploitation Citrix's bulletin said there was no evidence of in-the-wild exploitation at publication. Within a day, SecurityWeek and Lupovis reported opportunistic probing and exploitation attempts against internet-facing boxes. Treat "no known exploitation" on a NetScaler pre-auth bug as a countdown, not a comfort.

References

FAQ

What is CVE-2026-8451?

A pre-auth memory overread in Citrix NetScaler when it acts as a SAML identity provider. An attacker can read chunks of memory without logging in, which can leak session material. It echoes the earlier CitrixBleed issues.

Is CVE-2026-8451 exploitable without authentication?

Yes, that is what makes it serious. The overread happens before any login, so anyone who can reach the NetScaler endpoint can attempt it. Exposed gateway or management interfaces are the obvious risk.

How do I remediate CVE-2026-8451?

Patch to the fixed NetScaler build, then rotate anything that could have leaked, such as sessions and tokens. Reduce exposure of the interface and watch logs for the overread pattern. Patching alone does not undo data already read.