Citrix NetScaler SAML Memory Overread Flaw Exploited Within 24 Hours of Disclosure

Threat actors began exploiting a critical Citrix NetScaler vulnerability within 24 hours of public disclosure, according to telemetry from Lupovis decoy infrastructure.

The activity targeted NetScaler appliances configured as SAML Identity Providers and predates the flaw’s inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog.

CVE-2026-8451 is the latest entry in the CitrixBleed lineage of memory disclosure bugs, a recurring flaw pattern first surfaced in CVE-2023-4966 and repeated across CVE-2025-5777, CVE-2025-12101, and CVE-2026-3055.

The flaw resides in NetScaler’s custom XML parser for SAML AuthnRequest documents, and Citrix describes it plainly as “insufficient input validation leading to memory overread,” carrying a CVSS score of 8.8.

Citrix NetScaler SAML Memory Overread Flaw

When an unquoted attribute value is followed by a newline, the parser fails to terminate correctly and reads past the buffer boundary, leaking adjacent memory content into the NSC_TASS cookie returned to the client.

The vulnerability is unauthenticated and requires no credentials, but it is only exploitable when NetScaler is configured as a SAML IdP, a non-default setup common in enterprise SSO architectures.

Affected versions include NetScaler ADC and Gateway 14.1 before 14.1-72.61, and 13.1 before 13.1-63.18, along with corresponding FIPS builds.

Citrix disclosed the flaw on 30 June 2026 through advisory CTX696604 as part of a broader bulletin covering six NetScaler vulnerabilities, and watchTowr Labs published a Detection Artifact Generator the same day, having originally reported the underlying zero-day back in March 2026.

A single actor operating from IP 146.70.139.154, hosted on AS9009 (M247 Europe SRL) infrastructure in Frankfurt, swept three separate Lupovis sensor deployments in a five-hour window.

The host runs OpenSSH 7.4, a version released in December 2016, suggesting disposable or purpose-built scanning infrastructure rather than a maintained system. The campaign followed a clear validate-then-exploit pattern.

Initial probes against the first two sensors returned HTTP 404 responses and received no exploit payload, while the third sensor returned an HTTP 200 response and immediately received the full CVE-2026-8451 exploit payload via a POST request to /saml/login.

Lupovis stated that when decoded, the payload consisted of a bare <samlp:AuthnRequest> tag padded with 476 spaces and no closing tag, matching the exact overread variant published in watchTowr’s detection tooling.

This case highlights a dangerous gap in patch prioritization strategy. Because active exploitation occurred before CISA added the CVE to its KEV catalogue, organizations relying solely on KEV listings for urgency signals had a blind spot during the critical early window.

It also demonstrates the value of fleet-wide sensor correlation, since an isolated honeypot would have logged only a single data point, rather than revealing the full three-sensor sweep by a single actor.

The campaign further shows that attacker tooling actively validates targets before committing exploit code: sensors returning generic error responses were probed but never received the payload, whereas the one mimicking a legitimate response received the complete exploit chain immediately.

Organizations should patch to NetScaler ADC/Gateway version 14.1-72.61 or 13.1-63.18 without delay. If patching cannot occur immediately, disabling the SAML IdP configuration removes the attack precondition entirely.

Defenders should search logs for POST requests to /saml/login since 30 June 2026, decode any SAMLRequest values found for the telltale whitespace-padding signature, and inspect NSC_TASS cookie values for non-printable binary content that would confirm successful exploitation.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.