[HIGH PRIORITY] Citrix NetScaler SAML Heap Overflow RCE (CVE-2026-8452)

⚠ HIGH PRIORITY — CISA KEV (Aug 26, 2026). CVE-2026-8452 is a pre-authentication heap overflow in Citrix NetScaler ADC/Gateway SAML signature canonicalizer. Attackers send oversized SAML PrefixList values to achieve remote code execution — webshells (x.php, z.php) observed in active exploitation campaigns.

Affected NetScaler

• NetScaler ADC/Gateway 14.1 before 14.1-72.61
• NetScaler ADC/Gateway 13.1 before 13.1-63.18
• Branches 12.1 and 13.0 — end of life, no fix; migrate
• Gateway (SSL VPN, ICA Proxy) or AAA virtual server configured

Check version

show ns version
show vpn vserver
show authentication vserver

Patching Method

1. Upgrade to 14.1-73.32 or later (minimum fix: 14.1-72.61).
2. Alternatively upgrade 13.1 branch to 13.1-63.21 or later.
3. Download firmware from Citrix support portal (CTX696604).
4. Schedule maintenance — backup ns.conf before upgrade.
5. Apply firmware via CLI or GUI; reboot appliance.
6. Verify build with show ns version shows patched release.
7. Hunt for webshells in /var/tmp and audit VPN/AAA logs for SAML anomalies.

show ns version
grep -i saml /var/log/ns.log | tail -50

Until patched

• Restrict VPN/AAA virtual server to known IP ranges at firewall
• Disable SAML auth temporarily if alternate MFA available
• Migrate off EOL 12.1/13.0 branches immediately

CVSS: 8.8 High. Federal deadline: 29 Aug 2026.