High severity · published Jun 30, 2026
CVE-2026-8451
Insufficient input validation leading to memory overread
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML IDP
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NA
NetScaler ADC · Citrix
before 13.1-37.272; before 13.1-37.272; 13.1 before 13.1-63.18; 14.1 before 14.1-72.61; 14.1-66.68 · source: NVD
AD
ADC · NetScaler
14.1 before 72.61; 13.1 before 63.18; 14.1 FIPs before 72.61; 13.1 FIPS and NDcPP before 37.272 · source: vendor
GA
Gateway · NetScaler
14.1 before 72.61; 13.1 before 63.18 · source: vendor
In the news
VulnerabilityHigh
Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of-Service
Citrix on Tuesday released security updates to address multiple flaws in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) that could be exploited by an attacker to facilitate arbitrary file reads or trigger a denial-of-service (DoS) condition.
The vulnerabilities are listed below -
CVE-2026-8451 (CVSS score: 8.8) - An insufficient input validation
Jul 1, 2026·The Hacker News
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-8451
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-8451
Vendor Advisory
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604
More from NetScaler ADC
9.8
CVE-2026-88771
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
9.8
CVE-2026-19490
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
9.8
CVE-2026-8452
Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service
9.8
CVE-2026-3055
Insufficient input validation leading to memory overread
9.8
CVE-2025-7775
Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service