Security Advisory Desk
unratedQCS priority 70/100Citrix

CVE-2026-8452: Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

Citrix NetScaler ADC and NetScaler Gateway have a security flaw where memory is not properly checked, which can cause the devices to stop working correctly. This could lead to a denial of service, making the devices unavailable to users.

Published 26/8/2026, 12:00:00 amVerified 1/9/2026, 12:08:50 amRevision 1
Citrix unrated network security advisory visual

In plain language

What this advisory means

Citrix NetScaler ADC and NetScaler Gateway have a security flaw where memory is not properly checked, which can cause the devices to stop working correctly. This could lead to a denial of service, making the devices unavailable to users.

Technical explanation

How the issue affects the environment

The vulnerability in Citrix NetScaler ADC and NetScaler Gateway involves improper restriction of operations within the boundaries of a memory buffer, categorized under CWE-119 (Classic Buffer Overflow). This flaw allows actions that exceed the allocated memory, potentially causing the system to crash or behave unexpectedly, leading to a denial of service condition.

Operational impact

Why teams should care

If exploited, this vulnerability could cause critical Citrix networking devices to become unavailable, interrupting business operations that rely on secure application delivery and remote access. This may degrade user experience and impact service availability, carrying risks especially for organizations depending on these devices for secure network access.

Immediate action

Apply mitigations as instructed by Citrix. Organizations should follow CISA’s Binding Operational Directive (BOD) 26-04 guidance on prioritizing security updates based on risk, and comply with forensic triage requirements. If mitigations are unavailable, consider discontinuing use of the affected product. Evaluate exposure of assets to the internet and manage patching accordingly.

Affected and fixed releases

Affected versionsConfirm in the official vendor advisory
Fixed versionsConfirm in the official vendor advisory

Temporary risk reduction

No separate workaround was supplied in the source feed. Use the official vendor advisory before changing production controls.

Evidence and validation checklist

  • Official CISA Known Exploited Vulnerabilities Catalog entry for CVE-2026-8452
  • Citrix support article CTX696604 referenced
  • CISA BOD 26-04 guidance for patch prioritization and forensics triage linked
  • National Vulnerability Database entry for CVE-2026-8452

Authoritative reference

CISA Known Exploited Vulnerabilities

QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.

Open source