Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if…

CVE-2026-8451 is a pre-authentication out-of-bounds read (CWE-125) in the SAML IdP handler of NetScaler ADC and Gateway. The appliance uses a *custom* XML parser to handle the base64-encoded AuthnRequest sent to /saml/login; when an attribute value is left unquoted, the parser only stops on \0, >, or a matching quote — it does not stop on whitespace or newlines. Feeding it a crafted unquoted attribute lets the read walk past the intended buffer, and the leaked bytes are echoed back inside the NSC_TASS cookie. Affected builds: NetScaler ADC/Gateway 14.1 before 14.1-72.61 and 13.1 before 13.1-63.18, plus 14.1-72.61 FIPS and 13.1-37.272 FIPS/NDcPP branches.

Citrix rates this 8.8 HIGH (CVSS 4.0). That is *understated* for the population that actually runs the affected code path. NetScaler is a canonical internet-facing edge appliance, watchTowr has already published a working detection PoC that demonstrates repeatable heap leakage, and the direct predecessor in this bug class — CVE-2023-4966 *CitrixBleed* — leaked exactly the session token needed to skip MFA and take over authenticated sessions. Same appliance, same primitive, same payoff. Rate it CRITICAL and act accordingly.

Why this verdict

• Role multiplier — NetScaler is the edge: NetScaler ADC/Gateway is definitionally an internet-facing perimeter appliance and identity/VPN broker. When the leaked heap contains active AAA session tokens, the chain ends in *authenticated internal-app access without MFA*. That outcome on a canonical edge/identity component sets the floor at CRITICAL.
• Pre-auth, network-reachable, no user interaction: every prerequisite up to the leak is satisfied by anyone who can reach /saml/login. There is no authenticated-access downgrade to apply.
• CitrixBleed lineage: the *exact* predecessor primitive on the *exact* same appliance was mass-exploited by ransomware within days of PoC. Bayesian prior on this one is extremely bad.
• Public PoC already published (watchTowr) — weaponization delta is hours, not weeks.
• Adjustment — SAML IdP required: only NetScalers configured as SAML IdP are vulnerable. This narrows the exposed population but does *not* break the CRITICAL floor because the affected sub-population is precisely the identity-broker role — the highest-value deployment of the appliance.

Why not higher?

There is no vendor rating above CRITICAL; the score is already 9.3/10. Deducting 0.7 accounts for the SAML-IdP configuration prerequisite and the non-deterministic nature of what the memory disclosure returns — many requests may leak unhelpful heap before catching a live token.

Why not lower?

Downgrading to HIGH would require breaking the deployment-role floor, which is not defensible: NetScaler is canonically the edge/identity broker, the primitive is pre-auth, a public PoC exists, and the direct predecessor bug on the same appliance became one of the most-exploited vulnerabilities of its year. A generic 'requires SAML IdP config' friction argument is not sufficient to break the floor per noisgate role-multiplier rules.

1. Restrict /saml/login at the perimeter until patched — If you have an upstream WAF/CDN or a second reverse proxy, block or geo-fence POSTs to /saml/login on affected virtual servers. Deploy within 3 days per the noisgate CRITICAL mitigation SLA.
2. Unbind the SAML IdP vserver on any NetScaler that does not actually need it — Only SAML IdP-configured appliances are vulnerable. If SAML IdP was left bound experimentally or historically, unbind it now — kills the attack surface entirely. Complete within 3 days.
3. Kill and re-issue all AAA/VPN sessions post-patch — Because the primary loot is *session tokens*, patching alone is insufficient — anything leaked pre-patch is still valid until the session expires. Terminate all active sessions (kill aaa session -all, kill icaconnection -all) and rotate any stored secrets that live in NetScaler memory.
4. Enable AAA session IP-binding and shorten TTL — Bind AAA sessions to the originating client IP and reduce session TTL. Even if a token leaks, replay from a different IP fails. Apply within 3 days as belt-and-braces.
5. Hunt for indicators retroactively — Review NetScaler logs since disclosure (2026-06-30) for anomalous POSTs to /saml/login, high-entropy NSC_TASS cookies in responses, and any session reused across geolocations. Assume compromise if you were exposed and SAML IdP was configured.

Run this from an auditor workstation with network reach to the NetScaler appliance. Invoke as ./check-cve-2026-8451.sh https://netscaler.example.com. No credentials required — this is a safe version-and-endpoint check (it does *not* attempt to trigger the OOB read). Requires curl and jq.

#!/usr/bin/env bash
# noisgate verifier for CVE-2026-8451 (NetScaler SAML IdP memory overread)
# Safe check: fingerprints version banner and probes /saml/login existence.
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN
set -u

TARGET="${1:-}"
if [ -z "$TARGET" ]; then
  echo "usage: $0 https://<netscaler-host>" >&2
  exit 2
fi

CURL=(curl -sk --max-time 10 -o /dev/null -w '%{http_code}')

# 1. Confirm SAML IdP endpoint exists
SAML_CODE=$("${CURL[@]}" "$TARGET/saml/login")
if [ "$SAML_CODE" = "404" ] || [ "$SAML_CODE" = "000" ]; then
  echo "UNKNOWN: /saml/login not reachable (HTTP $SAML_CODE) — SAML IdP likely not configured or host unreachable"
  exit 2
fi

# 2. Grab version banner from logon page
BANNER=$(curl -sk --max-time 10 "$TARGET/vpn/index.html" 2>/dev/null | grep -oE 'NS[0-9]+\.[0-9]+(-[0-9]+\.[0-9]+)?' | head -1)
if [ -z "$BANNER" ]; then
  BANNER=$(curl -sk --max-time 10 "$TARGET/nitro/v1/config/nsversion" 2>/dev/null | grep -oE '[0-9]+\.[0-9]+-[0-9]+\.[0-9]+' | head -1)
fi

if [ -z "$BANNER" ]; then
  echo "UNKNOWN: could not fingerprint NetScaler version (SAML endpoint present, code $SAML_CODE)"
  exit 2
fi

echo "detected version: $BANNER"

# 3. Compare against fixed builds
# Fixed: 14.1-72.61+, 13.1-63.18+, 13.1-37.272+ (FIPS)
MAJOR=$(echo "$BANNER" | cut -d- -f1)
BUILD=$(echo "$BANNER" | cut -d- -f2)
BUILD_MAJ=$(echo "$BUILD" | cut -d. -f1)
BUILD_MIN=$(echo "$BUILD" | cut -d. -f2)

vuln=1
case "$MAJOR" in
  14.1)
    if [ "$BUILD_MAJ" -gt 72 ] || { [ "$BUILD_MAJ" -eq 72 ] && [ "$BUILD_MIN" -ge 61 ]; }; then vuln=0; fi ;;
  13.1)
    if [ "$BUILD_MAJ" -gt 63 ] || { [ "$BUILD_MAJ" -eq 63 ] && [ "$BUILD_MIN" -ge 18 ]; }; then vuln=0; fi
    # FIPS/NDcPP branch
    if [ "$BUILD_MAJ" -eq 37 ] && [ "$BUILD_MIN" -ge 272 ]; then vuln=0; fi ;;
  *)
    echo "UNKNOWN: unrecognized major version $MAJOR"; exit 2 ;;
esac

if [ "$vuln" -eq 1 ]; then
  echo "VULNERABLE: $BANNER is below fixed build; SAML IdP endpoint reachable — patch immediately"
  exit 1
fi
echo "PATCHED: $BANNER meets or exceeds fixed build"
exit 0

Sources

1. watchTowr Labs — CitrixBleed to Infinity and Beyond
2. IONIX Threat Center — CVE-2026-8451
3. The Hacker News — Citrix patches six NetScaler flaws
4. CyberScoop — Citrix patches new NetScaler flaw with echoes of CitrixBleed
5. PT Security dbugs — CVE-2026-8451 Out of bounds Read
6. Beazley Security advisory — NetScaler High-Severity Vulnerabilities
7. Tenable — CVE-2026-8451
8. GBHackers — NetScaler Memory Overread and DoS