Citrix NetScaler - Memory Disclosure (CVE-2026-8451)

CVE-2026-8451 is a high-severity vulnerability in NetScaler ADC and NetScaler Gateway that arises from insufficient input validation when configured as a SAML IDP, leading to potential memory overread. This flaw could allow remote attackers to access sensitive memory contents, potentially exposing confidential information and increasing the risk of further attacks.

CrowdSec has been tracking this vulnerability and its exploits since 1st of July 2026.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2026-8451 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. In addition, according to the CrowdSec network, attack volume against CVE-2026-8451 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit CVE-2026-8451 by sending specially crafted SAML authentication requests to the /saml/login endpoint on Citrix NetScaler appliances configured as a SAML IdP. Malformed or unquoted XML attribute values (such as AssertionConsumerServiceURL= or ID=) terminated with a newline or left unterminated can trigger a memory overread, causing the appliance to leak sensitive memory contents via the NSC_TASS cookie in the HTTP response.