Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451

In June 2026, Citrix disclosed a critical memory disclosure vulnerability, CVE-2026-8451, affecting NetScaler ADC and Gateway appliances. Discovered by watchTowr Labs, the flaw originates from a custom XML parser that fails to properly validate input when processing SAML authentication requests. This issue belongs to an ongoing class of vulnerabilities colloquially known as 'CitrixBleed' affecting memory management in these devices.

The vulnerability is exploitable when the appliance is configured as a SAML Identity Provider (IdP). By submitting malformed SAML requests with unquoted or improperly terminated attributes, attackers can force the parser to read beyond the request buffer. This results in the leakage of arbitrary binary data, such as process pointers or sensitive session information, back to the attacker via the NSC_TASS cookie.

Given that NetScaler devices are central to enterprise remote access and load balancing, this vulnerability poses a significant risk. It can be used as an information leak primitive to bypass security controls or, more simply, to crash the 'nsppe' process, leading to a total denial of service (DoS). Organizations are advised to patch immediately to the latest firmware versions.