Loading vulnerability…
CVE-2026-8451 is a high-severity pre-authentication information disclosure vulnerability in Citrix NetScaler ADC and NetScaler Gateway. The flaw is caused by insufficient input validation in SAML authentication request parsing when the appliance is configured as a SAML Identity Provider. NetScaler’s XML parsing logic can read beyond the intended bounds of XML attribute values when processing malformed SAML input, resulting in an out-of-bounds read and memory overread condition. Remote attackers can trigger the issue by sending crafted SAML authentication requests to the SAML login functionality exposed by a vulnerable appliance. Successful exploitation can cause fragments of process memory to be returned in HTTP responses, including authentication-related material and other sensitive in-memory data. The issue has been characterized as CitrixBleed-like because it enables remote disclosure of appliance memory from internet-facing NetScaler deployments under the affected configuration.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
Repository is a small standalone Python exploit PoC for CVE-2026-8451, a pre-authentication Citrix NetScaler/NetScaler Gateway SAML memory overread ('CitrixBleed'). Structure is minimal: one Python exploit script, one README, and a .gitignore. The main script, CVE-2026-8451.py, is the operational entry point and uses argparse plus the requests library to send crafted HTTP(S) requests to a user-supplied target. Based on the visible code and README, the exploit supports multiple malformed SAML AuthnRequest techniques, including deeply nested/mismatched XML, oversized NameID content, malformed signature/XML structures, and deflated/base64-encoded malformed payloads. The intended target is the unauthenticated /saml/login endpoint on Citrix NetScaler devices configured as a SAML IdP. The exploit appears designed to trigger an out-of-bounds read and recover leaked memory from HTTP responses, with options for proxying, timeout control, verbosity, SSL verification, and saving output to disk. This is not a framework module and not merely a detector; it is a direct exploitation PoC with basic but usable operational features.
Small repository containing one Python exploit script and two markdown files. The main file, watchTowr-vs-Netscaler-CVE-2026-8451.py, is a standalone operational proof-of-concept for CVE-2026-8451, a Citrix NetScaler memory overread issue. It creates a requests session, mounts a custom SSL adapter that lowers OpenSSL cipher security requirements and disables hostname/TLS verification, then repeatedly sends crafted POST requests to the target's /saml/login endpoint. The payload is a malformed SAML AuthnRequest whose size is varied from 1024 down to 2 bytes of padding to influence heap allocation behavior. The request is base64-encoded, then percent-encoded byte-by-byte, and submitted as the SAMLRequest form field. After each request, the script checks for an NSC_TASS cookie in the response, base64-decodes it, searches for the string ACSURL=, and prints any trailing bytes as leaked memory using a built-in hexdump routine. The repository purpose is memory disclosure validation / artifact generation rather than remote code execution. The readme documents usage, shows sample leaked output, and lists affected NetScaler ADC/Gateway versions from the Citrix advisory.
Small standalone Python exploit repository containing one executable script and one README. The main file, watchTowr-vs-Netscaler-CVE-2026-8451.py, is an operational proof-of-concept for CVE-2026-8451 affecting Citrix NetScaler ADC/Gateway. It uses requests with a custom SSL adapter that lowers OpenSSL security level to improve compatibility with NetScaler TLS configurations, disables certificate validation warnings, and repeatedly sends crafted POST requests to the target's /saml/login endpoint. The exploit builds malformed SAML AuthnRequest XML with varying whitespace lengths to influence heap allocation behavior, base64-encodes the request, percent-encodes the resulting bytes, and submits it as the SAMLRequest parameter. If exploitation succeeds, the appliance returns an NSC_TASS cookie whose decoded contents may contain leaked memory; the script searches for the ACSURL= marker and prints trailing bytes as a hexdump. The README documents usage, shows sample leaked output, and lists affected NetScaler versions from the Citrix advisory. Overall purpose: trigger and demonstrate a remote memory overread over HTTPS against vulnerable NetScaler SAML login functionality.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
108 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as related reading; no substantive discussion in the content.
A high-severity memory overread vulnerability in Citrix NetScaler ADC and NetScaler Gateway configured as a SAML identity provider, caused by insufficient input validation and allowing remote attackers to leak sensitive memory contents.
A memory overread vulnerability in Citrix NetScaler ADC and NetScaler Gateway when configured as a SAML Identity Provider, potentially leaking sensitive memory contents and compared to CitrixBleed-style flaws.
A vulnerability in NetScaler ADC, NetScaler Gateway, and NetScaler ADC FIPS that can cause memory overread when the appliance is configured as a SAML Identity Provider (IdP).
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.