CVE-2026-8451

🗓️ 30 Jun 2026 12:33:08Reported by NetScalerType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 189 Views🌐 WEB

Insufficient input validation causes memory overread when Netscaler is a SAML identity provider.

Reporter	Title	Published	Views	Family All 21
GithubExploit	Exploit for Out-of-bounds Read in Citrix Netscaler_Application_Delivery_Controller	7 Jul 202623:52	–	githubexploit
attackerkb	CVE-2026-8451	30 Jun 202612:33	–	attackerkb
BDU FSTEC	The vulnerability of the authentication mechanism of the SAML-based NetScaler ADC controller (formerly Citrix ADC) and the NetScaler Gateway virtual environment access control system (formerly Citrix Gateway) allows a attacker to cause service interruptions.	1 Jul 202600:00	–	bdu_fstec
Circl	CVE-2026-8451	30 Jun 202613:52	–	circl
Citrix	NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, and CVE-2026-13474	30 Jun 202611:30	–	citrix
Cvelist	CVE-2026-8451 Insufficient input validation leading to memory overread	30 Jun 202612:33	–	cvelist
EUVD	EUVD-2026-40305	30 Jun 202612:33	–	euvd
Kitploit	CVE-2026-8451	6 Oct 202613:28	–	kitploit
Kitploit	netscaler-saml-memory-disclosure-security-assessment	5 Oct 202617:18	–	kitploit
Kitploit	Netscaler-CVE-2026-8451	5 Oct 202616:24	–	kitploit

NVD

Node

citrix netscaler_application_delivery_controllerRange<13.1-37.272fips

citrix netscaler_application_delivery_controllerRange<13.1-37.272ndcpp

citrix netscaler_application_delivery_controllerRange13.1–13.1-63.18-

citrix netscaler_application_delivery_controllerRange14.1–14.1-72.61-

citrix netscaler_application_delivery_controllerMatch14.1-66.68fips

citrix netscaler_gatewayRange13.1–13.1-63.18

citrix netscaler_gatewayRange14.1–14.1-72.61

[
  {
    "vendor": "NetScaler",
    "product": "ADC",
    "versions": [
      {
        "status": "affected",
        "version": "14.1",
        "lessThan": "72.61",
        "versionType": "patch"
      },
      {
        "status": "affected",
        "version": "13.1",
        "lessThan": "63.18",
        "versionType": "patch"
      },
      {
        "status": "affected",
        "version": "14.1 FIPs",
        "lessThan": "72.61",
        "versionType": "patch"
      },
      {
        "status": "affected",
        "version": "13.1 FIPS and NDcPP",
        "lessThan": "37.272",
        "versionType": "patch"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "NetScaler",
    "product": "Gateway",
    "versions": [
      {
        "status": "affected",
        "version": "14.1",
        "lessThan": "72.61",
        "versionType": "patch"
      },
      {
        "status": "affected",
        "version": "13.1",
        "lessThan": "63.18",
        "versionType": "patch"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
support	www.support.citrix.com/support-home/kbsearch/article

Parameter	Position	Path	Description	CWE
SAMLRequest	request body	/saml/login	Out-of-bounds read/memory disclosure via crafted SAMLRequest to the /saml/login endpoint of Citrix NetScaler SAML IdP.	CWE-125

01 Jul 2026 15:52Current

8.2High risk

Vulners AI Score8.2

CVSS 3.17.5

CVSS 48.8

EPSS0.00502

SSVC