CVE-2026-8452Vulnerability
Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Reported by 4 independent sources · first reported by watchTowr Labs · last reported
Last reported 19 days ago
Fix due 29 Aug 2026
Used by ransomware: not knownCISA KEV catalogue
higher than 62% of CVEsFIRST EPSS, as of 24 Oct 2026
What the reports say
5 reports, newest first · the exact sentence from each-
Citrix NetScaler Targeted Via New Zero Day“Another memory overflow flaw affecting the two products, CVE-2026-8452, was added to CISA’s KEV list on August 26.”
-
Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug“CISA’s KEV catalog currently contains over a dozen Citrix NetScaler vulnerabilities, including the recently added CVE-2026-19490 and CVE-2026-8452.”
-
August 2026 CVE Landscape“CVE-2026-8452”
-
CISA Warns of Six Exploited Flaws in Microsoft, Linux, Red Hat and Citrix Products“The first, tracked as CVE-2026-8452, is a memory overflow vulnerability in NetScaler ADC and NetScaler Gateway.”
-
You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))“You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))”
Indicators reported together
named in the same reportsAlso named with it: CVE-2015-3246, CVE-2015-5287, CVE-2019-1068, CVE-2021-23758, CVE-2022-0995, CVE-2025-49113, CVE-2026-68820, CVE-2026-65400, CVE-2026-60004, CVE-2026-64849, CVE-2026-33824, CVE-2026-0300, CVE-2026-33017, CVE-2017-0199, CVE-2022-0847, CVE-2026-34486, CVE-2026-39987, CVE-2026-63030, CVE-2021-3156, CVE-2021-29441
Thanks — we review every report.