CVE-2026-8452 PoC: Citrix NetScaler pre-auth RCE detection and exploitation
github.com | vulnerability | Critical | CVE-2026-8452 | #rce | #public-poc | #pre-auth | #network-security | #authentication | #citrix | #netscaler | #memory-corruption | #cwe-119 | #cve | #poc | #saml | #cve-2026-8452
Summary
watchTowr's PoC covers CVE-2026-8452, a pre-auth flaw in Citrix NetScaler ADC/Gateway reachable when SAML is configured; offsets target build 13.1-30.52, with fixes in 14.1-72.61 and 13.1-63.18.
Why it matters
This is a public pre-auth remote-code-execution PoC, and although offsets are hardcoded for a specific build, it materially lowers the exploitation barrier. NetScaler administrators should upgrade affected builds per the Citrix bulletin and restrict exposed Gateway/AAA surfaces; use the PoC only in explicitly authorized isolated environments.
- CVE
- CVE-2026-8452
- Vendor
- Citrix / NetScaler
- Product
- NetScaler ADC and NetScaler Gateway
- Affected versions
- NetScaler ADC and Gateway 14.1 before 14.1-72.61; 13.1 before 13.1-63.18; 13.1 FIPS/NDcPP before 13.1-37.272; vulnerable when configured with SAML SP/IdP or Gateway/AAA virtual-server roles
- CVSS
- 9.8
- Published
- Collected
--- id: 6605 title: "CVE-2026-8452 PoC: Citrix NetScaler pre-auth RCE detection and exploitation" cve: CVE-2026-8452 cvss: 9.8 severity: critical vendor: "Citrix / NetScaler" product: "NetScaler ADC and NetScaler Gateway" affected_versions: "NetScaler ADC and Gateway 14.1 before 14.1-72.61; 13.1 before 13.1-63.18; 13.1 FIPS/NDcPP before 13.1-37.272; vulnerable when configured with SAML SP/IdP or Gateway/AAA virtual-server roles" source_domain: github.com source_url: "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452" published_at: "2026-08-14T15:01:25Z" tags: ["rce", "public-poc", "pre-auth", "network-security", "authentication", "citrix", "netscaler", "memory-corruption", "cwe-119", "cve", "poc", "saml", "cve-2026-8452"] phying_url: "https://phying.com/item/6605" lang: en --- # CVE-2026-8452 PoC: Citrix NetScaler pre-auth RCE detection and exploitation ## Summary watchTowr's PoC covers CVE-2026-8452, a pre-auth flaw in Citrix NetScaler ADC/Gateway reachable when SAML is configured; offsets target build 13.1-30.52, with fixes in 14.1-72.61 and 13.1-63.18. ## Why it matters This is a public pre-auth remote-code-execution PoC, and although offsets are hardcoded for a specific build, it materially lowers the exploitation barrier. NetScaler administrators should upgrade affected builds per the Citrix bulletin and restrict exposed Gateway/AAA surfaces; use the PoC only in explicitly authorized isolated environments. ## Intelligence Metadata - **Sources:** github.com - **CVE:** CVE-2026-8452 - **CVSS:** 9.8 - **Vendor:** Citrix / NetScaler - **Product:** NetScaler ADC and NetScaler Gateway - **Affected versions:** NetScaler ADC and Gateway 14.1 before 14.1-72.61; 13.1 before 13.1-63.18; 13.1 FIPS/NDcPP before 13.1-37.272; vulnerable when configured with SAML SP/IdP or Gateway/AAA virtual-server roles - **Published:** 2026-08-14T15:01:25Z - **Original:** https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452 - **Phying News:** https://phying.com/item/6605