CVE-2026-8452 in citrix netscaler application delivery controller
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server
Affected software: citrix netscaler application delivery controller, citrix netscaler gateway
Scores
- CVSS: 8.8 (high)
- EPSS: 1.01% chance of exploitation in the next 30 days
- CISA KEV: Known exploited, listed 2026-08-26
- Published: 2026-06-30
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Upgrade Citrix NetScaler ADC and Gateway for the memory buffer DoS (CVE-2026-8452)
Patch or upgrade. A memory handling flaw in NetScaler ADC and Gateway can be used to crash the appliance. Upgrading to a fixed build per CTX696604 removes it.
Applies to: NetScaler ADC and NetScaler Gateway builds listed in CTX696604.
- Check the build with `show ns version` on each appliance.
- Compare it with the fixed builds listed in Citrix bulletin CTX696604.
- Upgrade each appliance (HA pairs: secondary first, then fail over) to the fixed build.
- Monitor for unexpected restarts or core dumps after the upgrade (`shell ls /var/core`).
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.