Previously patched Citrix NetScaler flaw exploited in the wild (CVE-2026-8452)
Actively exploited Citrix NetScaler flaw CVE-2026-8452, patched in June, now added to CISA KEV; attackers deploy web shells and run discovery commands.
CISA added CVE-2026-8452, a memory overflow vulnerability in Citrix NetScaler ADC/Gateway, to its Known Exploited Vulnerabilities catalog on August 26, 2026, giving federal agencies until August 29 to remediate. Citrix disclosed and patched the flaw on June 30, 2026 in versions 14.1-72.61, 13.1-63.18, and 13.1-37.272. watchTowr Labs found the flaw can be chained into unauthenticated remote code execution and released a PoC on August 14. Previdian and Defused reported exploitation with web shells named x.php and z.php from at least three unique source IPs.
- CVE-2026-8452 affects NetScaler in Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server setups
- watchTowr Labs showed the DoS flaw chains into full unauthenticated RCE
- Exploitation began after the PoC release; web shells x.php and z.php observed
- CISA set a federal remediation deadline of August 29, 2026
- Five other older vulnerabilities were also added to the KEV catalog
- Products
- NetScaler ADCNetScaler Gateway
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-3246 | Race Condition in Red Hat libuser Allows Local Privilege Escalation | 7.4 | 9% | KEVPoC | KEV |
| CVE-2015-5287 | Local Privilege Escalation via Symlink Attack in Red Hat ABRT | — | 5% | KEV | — KEV |
| CVE-2019-1068 | Remote Code Execution in Microsoft SQL Server 2016 and 2017 | 8.8 | 57% | KEV | KEV |
| CVE-2021-23758 | Unauthenticated .NET Deserialization RCE in Ajax.NET Professional (ajaxpro.2) | 9.8 | 83% | KEVPoC ×2 | KEV |
| CVE-2022-0995 | Out-of-Bounds Write in Linux Kernel watch_queue Enables Local Privilege Escalation | 7.8 | 9% | KEVPoC ×2 | KEV |
| CVE-2026-8452 | Memory Buffer Overflow in Citrix NetScaler ADC/Gateway Exploited in the Wild | 8.8 | 1% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ajax.net | -2015-5287), a Microsoft SQL Server bug (CVE-2019-1068), an Ajax.NET deserialization flaw (CVE-2021-23758), and a Linux Kernel v |
From the original article
1 min read at helpnetsecurity.com
CISA added six new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including a previously patched Citrix NetScaler ADC and Gateway flaw, tracked as CVE-2026-8452, that is being exploited in the wild. The agency published the alert on August 26 and gave federal agencies until August 29 to remediate it.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.