CVE‑2026‑8452 Remote Code Execution in Citrix NetScaler ADC and Gateway – JPCERT Advisory

by

Overview

The JPCERT/CC advisory (AT‑2026‑0024) details a heap‑based buffer overflow in Citrix NetScaler ADC and NetScaler Gateway that can be exploited for pre‑authentication remote code execution (RCE) when the devices are configured as SAML Service Provider (SP) or Identity Provider (IdP). The vulnerability is identified as CVE‑2026‑8452.

Impact

Successful exploitation allows an attacker to execute arbitrary commands on the appliance without any authentication, potentially installing a webshell and gaining full control of the system.

Affected Products

  • NetScaler ADC and NetScaler Gateway versions prior to 14.1‑72.61
  • NetScaler ADC and NetScaler Gateway versions prior to 13.1‑63.18
  • NetScaler ADC FIPS prior to 14.1‑72.61 FIPS
  • NetScaler ADC FIPS and NDcPP prior to 13.1‑37.272

The vulnerability applies when the appliance is deployed as a gateway (SSL VPN, ICA proxy, CVPN, RDP proxy) or AAA virtual server, and specifically when SAML SP/IdP functionality is enabled.

Mitigation

Vendor recommendation (vendor claim): Cloud Software Group advises upgrading to the latest patched releases that address CVE‑2026‑8452. No temporary work‑around is provided.

Detection Guidance

  • Check for unexpected PHP files (e.g., /var/vpn/theme/x.php) that may indicate a webshell.
  • Inspect SAML authentication traffic for unusually large SAML Response payloads, especially in the SignedInfo or InclusiveNamespaces elements.
  • Monitor the nsppe process for crashes, rapid restarts, or PID changes following suspicious SAML requests.
  • Verify that /bin/sh permissions have not been altered, as the published PoC modifies them to elevate privileges.

Current Exploitation Status

As of the advisory date (2026‑08‑15), JPCERT/CC has not observed any active exploitation of CVE‑2026‑8452 in the wild, but warns that the publicly released PoC could lead to attacks.

References