CVE Tools
Track your stack

No Crash Required: Verifying the Citrix NetScaler SAML Patch for CVE-2026-8452

Bishop FoxBy Jon Williams, Threat Enablement & Analysis Team17 min read

ResearchCitrix NetScaler ADCCitrix NetScaler Gateway

Our summary

Bishop Fox has published a detection utility to help administrators verify the patch status of Citrix NetScaler ADC and Gateway appliances affected by CVE-2026-8452. This high-severity memory corruption vulnerability allows unauthenticated attackers to trigger remote code execution via SAML processing, requiring an upgrade to the latest 13.1 or 14.1 builds. The provided tool enables non-disruptive verification of the fix across virtual servers without crashing the appliance.

Read at Bishop Fox

Below is the opening; the full story is at Bishop Fox.

From Bishop Fox

TL;DR

CVE-2026-8452">CVE-2026-8452 is a memory corruption bug, a heap overflow, in the code that parses SAML single sign-on messages on Citrix NetScaler ADC and Gateway. It is rated CVSS 8.8 and needs no login to trigger. An attacker who can reach a Gateway or AAA virtual server with SAML configured corrupts memory in the process that carries all traffic through the appliance, using a single HTTP request, potentially causing remote code execution. Upgrade to the latest available 13.1 or 14.1 build , then confirm the upgrade took effect on every virtual server. Patch state is measurable from outside in one or two ordinary SAML requests, with no crash and no disruption to live sessions. We published that check as a CVE-2026-8452-check">detection tool covering both sides of the SAML exchange. Read on for specific guidance on the indicators of compromise to hunt for, including one crash signal that does not mean what it appears to mean.…

Continue at Bishop Fox
  1. The Hacker NewsWarning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active ExploitationCVE-2026-19490, CVE-2026-8452
  2. BleepingComputerCISA orders feds to patch Citrix NetScaler RCE flaw by SaturdayCVE-2026-19490, CVE-2026-8452
  3. SecurityWeekRecent Citrix NetScaler Vulnerability Exploited in the WildCVE-2026-8451, CVE-2026-8452
  4. The Hacker NewsCritical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA ServersCVE-2026-19490, CVE-2026-8451
  5. SecurityWeekCitrix Patches NetScaler Vulnerabilities, Including New ‘HTTP/2 Bomb’ AttackCVE-2026-8451, CVE-2026-8452
  6. The Hacker NewsCitrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-ServiceCVE-2026-8451, CVE-2026-8452
  7. Bishop FoxMind the Config: Detecting and Weaponizing NetScaler CVE-2026-19490CVE-2026-19490
  8. SecurityWeekCritical NetScaler Vulnerability Exploited in AttacksCVE-2026-19490
  9. The Hacker NewsCISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch DeadlineCVE-2026-19490
  10. BleepingComputerCritical Citrix NetScaler auth bypass now leveraged in attacksCVE-2026-19490

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store