Citrix NetScaler's Double Trouble: Active RCE Exploitation Meets a Fresh CVSS 9.3 Auth Bypass

Citrix dropped two security advisories for NetScaler ADC and NetScaler Gateway in a single week, and together they make an ugly picture. The first, CVE-2026-8452, is a pre-authentication memory overflow with a public proof-of-concept and confirmed exploitation in the wild. The second, CVE-2026-19490, is a fresh CVSS 9.3 authentication bypass disclosed August 19 that lets an unauthenticated attacker walk past the login screen entirely. Both hit the same device at the same place in your network: the edge, where your users connect remotely to everything that matters.

What NetScaler Is and Why Attackers Love It

Citrix NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway are application delivery controllers and SSL VPN appliances used by tens of thousands of organizations worldwide to handle remote access — SSL VPN, ICA Proxy, RDP Proxy, and Zero Trust Network Access (ZTNA). They sit at the perimeter by design, exposed directly to the internet so that remote users can authenticate and get in.

That positioning makes them extremely high-value targets. A pre-authentication vulnerability on a NetScaler appliance doesn't require a foothold inside your network; an attacker can reach it from anywhere on the internet, hit the vulnerability before a single credential is checked, and land inside the perimeter. Citrix products have historically attracted exploitation within days of public disclosure — the 2023 "Citrix Bleed" incident and the earlier critical bugs in 2019 and 2022 established the pattern. These two CVEs are arriving into that same playbook.

CVE-2026-8452: Memory Overflow with a Public Exploit and Active Exploitation

CVE-2026-8452 is a pre-authentication heap memory overflow in the AAA service, triggered when the appliance processes a malformed SAML PrefixList. The flaw carries a CVSS 4.0 score of 8.8 (High) and affects appliances configured as a Gateway — meaning SSL VPN, ICA Proxy, CVPN, or RDP Proxy — or as an AAA virtual server.

Security researchers published a working Python proof-of-concept demonstrating a path to remote code execution, and the Canadian Centre for Cyber Security confirmed exploitation in the wild on August 17, 2026. CISA added the flaw to its Known Exploited Vulnerabilities catalog. No authentication is required, and no user interaction is needed.

Fixed versions for CVE-2026-8452:

• NetScaler ADC and NetScaler Gateway 14.1-72.61 and later
• NetScaler ADC and NetScaler Gateway 13.1-63.18 and later
• NetScaler ADC FIPS 14.1-72.61 FIPS and later
• NetScaler ADC FIPS/NDcPP 13.1-37.272 and later

CVE-2026-19490: Authentication Bypass That Skips the Login Entirely

Two days after the exploitation news on CVE-2026-8452 went wide, Citrix published a second advisory on August 19 for CVE-2026-19490, rated CVSS v4.0 9.3 (Critical). This one is classified as CWE-288 — Authentication Bypass Using an Alternate Path — which means the attacker is not cracking passwords, stealing tokens, or brute-forcing anything. They are walking through a different door in the authentication logic that doesn't have the same checks the main path does.

An unauthenticated remote attacker with network access to the affected appliance can exploit this without any user interaction. The precondition is the same as CVE-2026-8452: the appliance must be configured as a Gateway or an AAA virtual server. On older firmware, the Gateway or AAA configuration alone is sufficient — SAML need not be configured. On certain newer builds, an active SAML action is required.

As of August 19, Rapid7 had not observed active exploitation of CVE-2026-19490 in the wild. That is not reassurance — it's a clock. Public disclosure of a critical authentication bypass on a perimeter device historically shortens the exploitation timeline to days.

Fixed versions for CVE-2026-19490:

• NetScaler ADC and NetScaler Gateway 14.1-73.32 and later
• NetScaler ADC and NetScaler Gateway 13.1-63.21 and later
• Corresponding FIPS and NDcPP builds at or above their respective fixed versions

Note that the fix versions differ between the two CVEs. For organizations running 14.1, you need at minimum 14.1-73.32 to address both. For 13.1, you need 13.1-63.21.

What to Do Right Now

If you run NetScaler ADC or NetScaler Gateway in a Gateway or AAA configuration, this is a patch-now situation. Specifically:

• Identify your firmware branch and build. Log into the appliance and confirm which version you're running. Both the 13.1 and 14.1 branches have fixes available; check Citrix advisory CTX696604 for the full version matrix.
• Apply the highest patched build for your branch. For 14.1, that is 14.1-73.32 or later. For 13.1, it is 13.1-63.21 or later.
• Restrict management-plane access immediately if you cannot patch right now. Lock the management interface to a specific administrative IP range, put it behind a jump host or VPN segment, and ensure it is not reachable from the internet. This does not mitigate the data-plane exposure for a device acting as a public SSL VPN, but it limits the blast radius.
• Review VPN access logs for anomalous session creation, unexpected source IPs, or failed AAA negotiations in the days before patching. CVE-2026-8452 exploitation may have left artifact entries around memory fault records or unusual SAML processing errors.
• Check for end-of-life appliances. Citrix's statement on both advisories does not address 12.x and earlier branches — those are past end of support and will not receive patches. If you're running anything in the 12.x line, your only remediation is upgrade or decommission.

The Broader Pattern

Two pre-authentication, perimeter-level vulnerabilities in one week on a single platform is not bad luck. It is a natural consequence of the architecture: complex authentication and protocol-handling code, exposed directly to the internet, written when the threat model looked different. Citrix has been here before — Citrix Bleed in 2023, CVE-2019-19781, the 2022 Critical Authentication flaws — and the pattern each time is fast exploitation followed by wide-scale ransomware deployment or persistent access.

Falcon Internet's 24x7x365 NOC monitoring is partly built around exactly this kind of advisory cadence: when a critical perimeter CVE drops on a Tuesday, you want someone who knows what firmware your appliances are running before noon, not a week later during the next change-management cycle. The gap between disclosure and exploitation is narrowing. The response window has to narrow with it.