---
title: "Citrix NetScaler RCE (CVE-2026-8452)"
canonical: https://trickest.com/library/citrix-netscaler-rce-check-cve-2026-8452
description: "CVE-2026-8452 is a heap overflow in Citrix NetScaler ADC and Gateway. Version flag only. No confirm: a probe would crash the box or be RCE."
---

# Citrix NetScaler RCE (CVE-2026-8452)

## Overview

CVE-2026-8452 is a heap overflow in Citrix NetScaler ADC and Gateway SAML signature canonicalization. watchTowr disclosed it in August 2026. An unauthenticated attacker can corrupt packet-engine state when the appliance is a SAML SP or IdP. You point this workflow at hostnames, IP addresses, or URLs you are authorised to test. It fingerprints the public page (title match on NetScaler), reads the version from `/` with a fallback to the root body, and compares that number to the range table in the graph. You get an affected or not row per host, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management).

The graph has no confirm node. Confirming a heap overflow would crash the appliance or be RCE, and there is no non-intrusive probe. Detection stays fingerprint plus version. A flagged row is patch-lag, not proof the overflow ran. This page is a standalone check, not part of the KEV Collection, because CISA had not listed the ID on KEV when the workflow shipped.

Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. Fingerprint each host as Citrix NetScaler ADC and Gateway from the public page title, then GET `/` and parse the version. A host counts as affected only when the fingerprint matches and the version is inside the encoded range.
3. Collect the per-host rows: product match, version read, affected flag, and any fetch error.
4. Emit the summary counts: hosts checked, product hits, affected, and errors.

## Inputs

- **Target list.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. JSONL with a `url` field also works. Point it at scope you are authorised to test. The check only sends read-only GET requests.

## Outputs

- **results.jsonl.** One row per host: URL, whether Citrix NetScaler ADC and Gateway was detected, the version read, and the affected flag.
- **summary.json.** Counts across the list: targets, product hits, affected, and errors.

## Integrations

- HTTP. Unauthenticated GET to the product root and `/`. No login, no exploit payload, no confirm probe.

## Sample output

The records below are illustrative and do not come from a real run. They show one Citrix NetScaler ADC and Gateway host inside the CVE-2026-8452 range, one patched host, and one host that is not the product.

```jsonl
{"target_url": "https://vpn-a.example.com", "product_detected": true, "version": "13.1-63.17", "affected": true, "error": null}
{"target_url": "https://vpn-b.example.org", "product_detected": true, "version": "14.1-72.61", "affected": false, "error": null}
{"target_url": "https://shop.example.net", "product_detected": false, "version": null, "affected": false, "error": "not_product"}
```

```json
{"cve": "CVE-2026-8452", "total_targets": 3, "affected": 1, "not_affected": 1, "errors": 1}
```

## FAQ

### Which Citrix NetScaler ADC and Gateway versions does this flag?

14.1 before 14.1-72.61, and 13.1 before 13.1-63.18. 14.1-72.61 and 13.1-63.18 or later on those lines is the floor the graph treats as not affected. The compare uses the version the product itself served.

### Why is there no confirm step?

CVE-2026-8452 is a heap overflow. There is no non-intrusive probe. A confirm would crash the packet engine or execute code. The DAG stays targets, check, collect, summary.

### Does a flagged host mean CVE-2026-8452 was exploited?

No. A flagged row is patch-lag against the range table. The run does not exercise the heap overflow. Treat it as a patching signal.

### Is this check safe on production?

Yes. It only sends read-only GET requests to the login or version endpoint. It does not log in and it does not send an exploit.

### Does the check need credentials?

No. It fingerprints the public page and reads `/` the way an external scanner would.

## Related workflows

- [NetScaler SAML Auth Bypass (CVE-2026-19490)](/library/citrix-netscaler-saml-auth-bypass-check-cve-2026-19490). Reach for it instead when you need a safe SAML config oracle on the same appliance, not a heap-overflow version flag.
- [LoadMaster RCE (CVE-2026-8037)](/library/loadmaster-command-injection-check-cve-2026-8037). Reach for it when the next edge RCE flag is a Progress ADC.
- [Full Network Port and Service Assessment](/library/full-network-port-and-service-assessment). Reach for it when you still need to find which hosts speak the NetScaler login.

---
_Markdown source of https://trickest.com/library/citrix-netscaler-rce-check-cve-2026-8452._