CitrixBleed To Infinity And Beyond: New Memory Overread Flaw in NetScaler Appliances

WatchTowr Labs has identified and publicly disclosed a new pre-authentication memory overread vulnerability in Citrix NetScaler appliances, a flaw they've creatively named "CitrixBleed To Infinity And Beyond." This vulnerability, officially cataloged as CVE-2026-8451, was initially reported by WatchTowr in March 2026 and has now been confirmed and disclosed by Citrix. The issue arises from insecure XML parsing within the SAML Identity Provider (IdP) functionality of the NetScaler devices.

The vulnerability's root cause lies in the way NetScaler appliances handle XML parsing for SAML authentication requests. Attackers can exploit this flaw by sending specially crafted XML documents to the SAML login endpoint. The insecure parsing mechanism allows for a memory overread, potentially enabling the disclosure of sensitive memory contents from the appliance. This continues a concerning pattern of memory disclosure vulnerabilities affecting Citrix NetScaler devices, raising questions about the overall security posture of these critical network appliances.

Citrix has assigned CVE-2026-8451 a CVSS score of 8.8, classifying it as a high-severity vulnerability. Exploitation requires the NetScaler appliance to be configured as a SAML IdP. Affected versions include NetScaler ADC and NetScaler Gateway versions 14.1 before 14.1-72.61, 13.1 before 13.1-63.18, and their FIPS and NDcPP variants. Citrix has released patches for these versions, urging customers to update immediately to mitigate the risk.

This discovery highlights a persistent trend of memory-related vulnerabilities within Citrix NetScaler products. WatchTowr Labs notes that this is not an isolated incident, referencing previous disclosures such as CVE-2025-5777 ("CitrixBleed 2"), CVE-2025-12101, and CVE-2026-3055. The repeated emergence of similar flaws suggests systemic issues with memory management and secure coding practices within the NetScaler platform.

NetScaler appliances, including NetScaler Gateway, are widely deployed in enterprise networks, serving critical functions such as load balancing, SSL offloading, and providing secure remote access. Their role as a front-door for many organizations' remote infrastructure makes vulnerabilities like CVE-2026-8451 particularly impactful, as they can serve as an entry point for attackers to gain access to sensitive internal networks.

The implications of this vulnerability extend beyond mere technical flaws. The repeated nature of these 'bleed' vulnerabilities, as WatchTowr terms them, erodes trust in the security of these devices. Organizations relying on NetScaler for their security infrastructure may need to re-evaluate their risk posture and consider the ongoing threat posed by these endemic memory disclosure issues.

WatchTowr Labs' detailed analysis points to the complexity and inherent difficulty in correctly implementing XML parsers, suggesting that Citrix may have opted for a less robust implementation. The ongoing discovery of such vulnerabilities underscores the need for rigorous security auditing and secure development lifecycle practices within vendors of critical network infrastructure. The cybersecurity community will be watching closely to see if Citrix can address these systemic issues to prevent future 'bleeding' incidents.

Citrix has released security updates for NetScaler ADC and Gateway addressing six vulnerabilities, including CVE-2026-8451, a high-severity memory disclosure flaw similar to the past CitrixBleed incident. Discovered by watchTowr, this flaw stems from improper parsing of SAML authentication requests. The bulletin also details five other bugs, including denial-of-service conditions and arbitrary file read vulnerabilities.