CitrixBleed To Infinity And Beyond: New Memory Overread Flaw in NetScaler Appliances
WatchTowr Labs has disclosed CVE-2026-8451, a pre-authentication memory overread vulnerability in Citrix NetScaler appliances, dubbed 'CitrixBleed To Infinity And Beyond,' stemming from insecure XML parsing.
WatchTowr Labs has identified and publicly disclosed a new pre-authentication memory overread vulnerability in Citrix NetScaler appliances, a flaw they've creatively named "CitrixBleed To Infinity And Beyond." This vulnerability, officially cataloged as CVE-2026-8451, was initially reported by WatchTowr in March 2026 and has now been confirmed and disclosed by Citrix. The issue arises from insecure XML parsing within the SAML Identity Provider (IdP) functionality of the NetScaler devices.
The vulnerability's root cause lies in the way NetScaler appliances handle XML parsing for SAML authentication requests. Attackers can exploit this flaw by sending specially crafted XML documents to the SAML login endpoint. The insecure parsing mechanism allows for a memory overread, potentially enabling the disclosure of sensitive memory contents from the appliance. This continues a concerning pattern of memory disclosure vulnerabilities affecting Citrix NetScaler devices, raising questions about the overall security posture of these critical network appliances.
Citrix has assigned CVE-2026-8451 a CVSS score of 8.8, classifying it as a high-severity vulnerability. Exploitation requires the NetScaler appliance to be configured as a SAML IdP. Affected versions include NetScaler ADC and NetScaler Gateway versions 14.1 before 14.1-72.61, 13.1 before 13.1-63.18, and their FIPS and NDcPP variants. Citrix has released patches for these versions, urging customers to update immediately to mitigate the risk.
This discovery highlights a persistent trend of memory-related vulnerabilities within Citrix NetScaler products. WatchTowr Labs notes that this is not an isolated incident, referencing previous disclosures such as CVE-2025-5777 ("CitrixBleed 2"), CVE-2025-12101, and CVE-2026-3055. The repeated emergence of similar flaws suggests systemic issues with memory management and secure coding practices within the NetScaler platform.
NetScaler appliances, including NetScaler Gateway, are widely deployed in enterprise networks, serving critical functions such as load balancing, SSL offloading, and providing secure remote access. Their role as a front-door for many organizations' remote infrastructure makes vulnerabilities like CVE-2026-8451 particularly impactful, as they can serve as an entry point for attackers to gain access to sensitive internal networks.
The implications of this vulnerability extend beyond mere technical flaws. The repeated nature of these 'bleed' vulnerabilities, as WatchTowr terms them, erodes trust in the security of these devices. Organizations relying on NetScaler for their security infrastructure may need to re-evaluate their risk posture and consider the ongoing threat posed by these endemic memory disclosure issues.
WatchTowr Labs' detailed analysis points to the complexity and inherent difficulty in correctly implementing XML parsers, suggesting that Citrix may have opted for a less robust implementation. The ongoing discovery of such vulnerabilities underscores the need for rigorous security auditing and secure development lifecycle practices within vendors of critical network infrastructure. The cybersecurity community will be watching closely to see if Citrix can address these systemic issues to prevent future 'bleeding' incidents.
Citrix has released security updates for NetScaler ADC and Gateway addressing six vulnerabilities, including CVE-2026-8451, a high-severity memory disclosure flaw similar to the past CitrixBleed incident. Discovered by watchTowr, this flaw stems from improper parsing of SAML authentication requests. The bulletin also details five other bugs, including denial-of-service conditions and arbitrary file read vulnerabilities.
Citrix has released security updates for NetScaler ADC and Gateway to address six vulnerabilities, including CVE-2026-8451, which is related to the previously disclosed 'CitrixBleed To Infinity And Beyond' flaw. While the new advisory details multiple denial-of-service vulnerabilities and an arbitrary file read flaw (CVE-2026-10816), the company has provided specific patch versions and configuration adjustments for CVE-2026-13474, which requires manual intervention for non-HTTP Strict Profile deployments.
This new report details six distinct vulnerabilities affecting Citrix NetScaler ADC and Gateway, including CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, and CVE-2026-13474. While the previous article highlighted CVE-2026-8451 as a memory overread flaw, this update expands the scope to include additional issues that enable denial-of-service conditions and memory overflows, affecting versions 14.1 before 14.1-72.61 and 13.1 before 13.1-63.18.
Exploitation of the CVE-2026-8451 vulnerability, dubbed CitrixBleed, began within 24 hours of its public disclosure, significantly outpacing its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog. Threat actors were observed actively scanning and delivering payloads to NetScaler appliances configured as SAML Identity Providers, mirroring the rapid exploitation seen in previous CitrixBleed incidents.
The new article details how ransomware groups, specifically the Anubis operation, are actively exploiting the Citrix Bleed 2 vulnerability (CVE-2025-5777) for initial access. This builds upon the existing reporting of Citrix NetScaler appliance vulnerabilities by highlighting a specific, active exploitation vector used by threat actors for malicious purposes, alongside their use of legitimate RMM tools and credential access techniques.
Threat actors are actively exploiting a critical memory disclosure vulnerability in Citrix NetScaler appliances, following the recent release of a proof-of-concept exploit. This rapid exploitation underscores the immediate danger posed by unpatched systems, as attackers are wasting no time in targeting the flaw.
New analysis reveals that threat actors can progress from exploiting the CVE-2025-5777 vulnerability, dubbed CitrixBleed 2, to deploying ransomware in under an hour. Huntress identified a standardized seven-stage playbook used by attackers, which includes reusing stolen session tokens to bypass MFA, escalating privileges, and deploying remote-management tools before ransomware execution.