---
id: 6605
title: "CVE-2026-8452 PoC: Citrix NetScaler pre-auth RCE detection and exploitation"
cve: CVE-2026-8452
cvss: 9.8
severity: critical
vendor: "Citrix / NetScaler"
product: "NetScaler ADC and NetScaler Gateway"
affected_versions: "NetScaler ADC and Gateway 14.1 before 14.1-72.61; 13.1 before 13.1-63.18; 13.1 FIPS/NDcPP before 13.1-37.272; vulnerable when configured with SAML SP/IdP or Gateway/AAA virtual-server roles"
source_domain: github.com
source_url: "https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452"
published_at: "2026-08-14T15:01:25Z"
tags: ["rce", "public-poc", "pre-auth", "network-security", "authentication", "citrix", "netscaler", "memory-corruption", "cwe-119", "cve", "poc", "saml", "cve-2026-8452"]
phying_url: "https://phying.com/item/6605"
lang: en
---

# CVE-2026-8452 PoC: Citrix NetScaler pre-auth RCE detection and exploitation

## Summary

watchTowr's PoC covers CVE-2026-8452, a pre-auth flaw in Citrix NetScaler ADC/Gateway reachable when SAML is configured; offsets target build 13.1-30.52, with fixes in 14.1-72.61 and 13.1-63.18.

## Why it matters

This is a public pre-auth remote-code-execution PoC, and although offsets are hardcoded for a specific build, it materially lowers the exploitation barrier. NetScaler administrators should upgrade affected builds per the Citrix bulletin and restrict exposed Gateway/AAA surfaces; use the PoC only in explicitly authorized isolated environments.

## Intelligence Metadata

- **Sources:** github.com
- **CVE:** CVE-2026-8452
- **CVSS:** 9.8
- **Vendor:** Citrix / NetScaler
- **Product:** NetScaler ADC and NetScaler Gateway
- **Affected versions:** NetScaler ADC and Gateway 14.1 before 14.1-72.61; 13.1 before 13.1-63.18; 13.1 FIPS/NDcPP before 13.1-37.272; vulnerable when configured with SAML SP/IdP or Gateway/AAA virtual-server roles
- **Published:** 2026-08-14T15:01:25Z
- **Original:** https://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452
- **Phying News:** https://phying.com/item/6605