A working proof-of-concept exploit has been developed to demonstrate how a pre-authentication heap overflow in Citrix NetScaler ADC and Gateway can be leveraged into unauthenticated root-level remote code execution (RCE). The vulnerability was initially addressed by Cloud Software Group’s June 30 security bulletin CTX696604, where Citrix identified CVE-2026-8452 as a memory overflow that could lead to denial-of-service or unpredictable behavior. WatchTowr Labs reported in a ZeroOwl report that the flaw can be exploited without credentials and grants access to nsppe, the packet-processing engine already executing as root.
CVE-2026-8452 involves configurations of AAA virtual servers or gateways such as SSL VPN, ICA Proxy, CVPN, and RDP proxies.
Researchers reverse-engineered and diffed stripped binaries from nsppe (NetScaler Packet Processing Engine) to identify the critical issue: missing bounds checks during XML signature canonicalization, which leads to an overflow in a signed SAML message’s SignedInfo element. Prior to deploying a webshell via HTTP 404 response, an attacker can corrupt subsequent memory copies, allowing them to hijack function pointers and redirect control flow to root-level shellcode. Citrix confirmed that its managed cloud services were upgraded ahead of disclosure, revealing a related SAML information-disclosure bug from the same advisory (CVE-2026-8451) was actively probed within 24 hours of its release, indicating threat actors frequently exploit NetScaler advisories.
