Loading story…
Citrix released patches for six vulnerabilities in NetScaler ADC, NetScaler Gateway, and related FIPS/NDcPP variants, including CVE-2026-8451, a high-severity CitrixBleed-style information disclosure flaw, and an HTTP/2 Bomb denial-of-service issue. Citrix said the bugs affect deployments under specific configuration conditions, but urged customers to assess exposure and update affected self-managed NetScaler and Citrix Secure Private Access Hybrid instances. The most urgent issue, CVE-2026-8451, is an out-of-bounds read in NetScaler’s XML parser that can leak restricted memory in the NSC_TASS cookie when appliances are configured as SAML Identity Providers.
Security researchers reported that CVE-2026-8451 was exploited in the wild less than 24 hours after disclosure. Lupovis observed threat actors probing exposed NetScaler systems and sending exploit payloads immediately after receiving valid 200 OK responses, including a malformed <samlp:AuthnRequest> padded with hundreds of spaces that matched watchTowr’s published detection artefact pattern; one campaign was linked to 146.70.139[.]154. Defenders were advised to patch immediately, disable SAML IDP if patching was not possible, and review /saml/login traffic and anomalous NSC_TASS cookie values for signs of compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-03, HKCERT published a security bulletin covering multiple vulnerabilities in Citrix products. The advisory represents an additional official CERT warning following Citrix's June 30 disclosure.
Less than 24 hours after public disclosure, Lupovis observed at least two threat actors probing exposed NetScaler appliances and sending exploit payloads after receiving valid HTTP 200 responses. The activity targeted deployments configured as SAML identity providers and used payloads matching the watchTowr artefact pattern.
On July 2, 2026, the Canadian Centre for Cyber Security published Alert AL26-016 بشأن CVE-2026-8451 affecting customer-managed Citrix NetScaler appliances. The alert urged organizations to patch immediately, noted Citrix-managed cloud services had already been updated, and advised following Citrix compromise guidance if exploitation is suspected.
On June 30, 2026, watchTowr published technical details for CVE-2026-8451 along with a detection artefact generator. The published pattern was later seen reflected in observed exploit payloads targeting exposed NetScaler instances.
On June 30, 2026, Citrix disclosed six vulnerabilities affecting NetScaler ADC, NetScaler Gateway, and related variants, including CVE-2026-8451, and released security updates for affected versions. The issues included the new HTTP/2 Bomb denial-of-service flaw and a CitrixBleed-style information disclosure bug with configuration-specific preconditions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
thecyberthrone.in
Open sourcehkcert.org
Open sourcecyber.gc.ca
Open sourcecybersecuritynews.com
Open sourcesecurityweek.com
Open sourcesecurityweek.com
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citrix disclosed **CVE-2025-5777** in NetScaler ADC and NetScaler Gateway alongside **CVE-2025-5349**, warning that affected appliances could be exposed to remote exploitation. Public tracking by ENISA’s EUVD and subsequent reporting identified `CVE-2025-5777` as **CitrixBleed 2**, linking the issue to session exposure risks on internet-facing NetScaler deployments and raising concern for organizations that rely on the products for remote access. After the advisory, proof-of-concept and scanning tools for `CVE-2025-5777` appeared on GitHub, including repositories explicitly branded as **CitrixBleed 2** scanners. The rapid publication of exploit-related code lowered the barrier for attackers to identify vulnerable devices, increasing urgency for defenders to patch NetScaler systems, review exposed gateways, and monitor for signs of session theft or unauthorized access.
Jul 3, 2026
Citrix published a security advisory for **NetScaler ADC** and **NetScaler Gateway**, warning that multiple high-severity vulnerabilities can be exploited remotely in specific deployments and configurations. The advisory, highlighted by the Canadian Centre for Cyber Security, affects the `14.1` and `13.1` release lines as well as certain **NetScaler FIPS** and **NDcPP** editions, and references six CVEs including `CVE-2026-8451`, `CVE-2026-8452`, `CVE-2026-8655`, and `CVE-2026-13474`. Administrators were urged to review Citrix’s bulletin and move affected systems to fixed versions. The disclosed flaws include a malformed HTTP/2 request issue that can trigger denial of service when HTTP/2 is enabled on affected LB, CS, VPN virtual servers or services (`CVE-2026-13474`); multiple memory overflow vulnerabilities tied to Oracle load balancer, DNS proxy, and DNS recursive resolver deployments (`CVE-2026-8655`); a memory overread caused by insufficient input validation when NetScaler is configured as a **SAML Identity Provider** (`CVE-2026-8451`); and a separate memory overflow vulnerability affecting **Gateway** or **AAA** virtual servers, including **SSL VPN**, **ICA Proxy**, **CVPN**, and **RDP Proxy** deployments (`CVE-2026-8452`). Recommended mitigations include applying Citrix security updates, disabling HTTP/2 or vulnerable Gateway features where not required, reviewing exposed virtual server and HTTP profile configurations, and monitoring for anomalous behavior.
Jul 1, 2026
Multiple severe vulnerabilities in **Citrix ADC** and **NetScaler Gateway** exposed organizations to unauthenticated compromise, including remote code execution in `CVE-2019-19781` and `CVE-2023-3519`, as well as memory disclosure in `CVE-2023-4966` (**CitrixBleed**) and the later `CVE-2025-5777` variant. Public reporting showed that `CVE-2019-19781` could be exploited through crafted HTTP requests that abused directory traversal and template parsing to execute commands on vulnerable appliances, while research on `CVE-2023-3519` examined another critical path to code execution on internet-facing Citrix infrastructure.
Jun 29, 2026