Citrix NetScaler Vulnerable to Pre-Authentication RCE via SAML Heap Overflow
A critical heap overflow vulnerability in Citrix NetScaler ADC and Gateway, potentially CVE-2026-8452, allows unauthenticated remote code execution when SAML is configured.
Researchers at watchTowr Labs have detailed a critical heap overflow vulnerability affecting Citrix NetScaler ADC and Gateway appliances, which can be exploited for unauthenticated remote code execution (RCE). The vulnerability, which the researchers believe is CVE-2026-8452, impacts specific versions of NetScaler when configured to use Security Assertion Markup Language (SAML) for authentication.
Citrix NetScaler, a widely deployed application delivery controller and VPN gateway, plays a crucial role in enterprise network infrastructure, handling load balancing, SSL offloading, and remote access. The NetScaler Gateway component, in particular, serves as the primary entry point for remote access for numerous organizations. The vulnerability lies within the SAML authentication functionality of the appliance.
According to the advisory, the affected versions are NetScaler ADC and NetScaler Gateway 14.1 prior to build 14.1-72.61 and 13.1 prior to build 13.1-63.18. Exploitation is possible when the NetScaler appliance is configured to act as either a Service Provider (SP) or an Identity Provider (IdP) within a SAML setup. This configuration requirement is key to understanding the attack vector.
The vulnerability stems from how earlier versions of NetScaler process SAML messages. During the signature canonicalization process, the appliance copies data from the SAML message's ds:SignedInfo element into a fixed-size global buffer. Crucially, this copy operation lacks proper size checks, allowing an attacker to send an oversized SignedInfo element. This overflow corrupts adjacent packet-engine state, ultimately leading to a crash of the nsppe binary, the core packet processing engine.
While Citrix has not officially correlated the CVEs with specific researcher findings in their security bulletin, watchTowr Labs strongly suspects this heap overflow vulnerability corresponds to CVE-2026-8452, described as a "Memory Overflow." Their theory is further supported by the fact that one of the credited researchers for the advisory is from JPMorgan Chase, an organization known to leverage advanced AI research models like Mythos, which could have aided in discovering such a complex vulnerability.
The researchers provided a technical walkthrough demonstrating the exploit chain, highlighting how an unauthenticated attacker could leverage this flaw. The core of the exploit involves crafting a malicious SAML request with an oversized SignedInfo element. This crafted request, when processed by the vulnerable NetScaler appliance, triggers the heap overflow, leading to memory corruption and subsequent remote code execution.
This discovery is significant as it marks the first publicly documented NetScaler RCE write-up in three years. The potential for unauthenticated exploitation on such a widely used gateway product makes it a high-priority target for attackers. Organizations utilizing affected NetScaler versions with SAML configurations are strongly advised to update to the patched versions immediately to mitigate the risk of compromise.
Mitigation requires updating the NetScaler ADC and Gateway to the latest patched versions. Administrators should consult Citrix's security bulletin for detailed instructions and verify their SAML configurations. The widespread deployment of NetScaler makes this vulnerability a critical concern for enterprise security, potentially opening doors for attackers to gain initial access to sensitive internal networks.