Citrix security advisory (AV26-645) – Update 3
Canada's Cyber Centre updates Citrix advisory as CVE-2026-8451 and CVE-2026-8452 in NetScaler ADC/Gateway are confirmed exploited in the wild.
The Canadian Centre for Cyber Security updated advisory AV26-645 on August 26, 2026, covering critical vulnerabilities in Citrix NetScaler ADC and Gateway (versions 14.1 before 14.1-72.61 and 13.1 before 13.1-63.18, plus FIPS builds). Open-source reporting indicates CVE-2026-8451 and CVE-2026-8452 are being exploited in the wild. Update 3 references related CISA action, and patched builds were released starting June 30, 2026.
- Critical flaws in NetScaler ADC and Gateway with patches available since June 30
- CVE-2026-8451 and CVE-2026-8452 confirmed exploited in the wild
- Update 3 notes related CISA action; administrators should upgrade immediately
- Vendors
- Citrix
- Products
- NetScaler ADCNetScaler Gateway
- Organizations
- Canadian Centre for Cyber SecurityCISA
- Countries
- CanadaUnited States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-8451 | Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML… | 8.8 | 16% | ||
| CVE-2026-8452 | Memory Buffer Overflow in Citrix NetScaler ADC/Gateway Exploited in the Wild | 8.8 | 1% | KEVPoC | KEV |
From the original article
Serial number: AV26-645 Date: June 30, 2026 Updated: August 26, 2026 On June 30, 2026, Citrix published a security advisory to address critical vulnerabilities in the following products: NetScaler ADC and NetScaler Gateway - versions 14. 1 before 14. 1-72.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.