New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure

1. Executive summary

A new CitrixBleed-like vulnerability (CVE-2026-8451, CVSS 8.8) in NetScaler ADC and NetScaler Gateway appliances was exploited in the wild less than 24 hours after public disclosure on 30 June 2026. The flaw is an unauthenticated out-of-bounds read in NetScaler's XML parser affecting appliances configured as SAML IDP, returning arbitrary memory contents in the NSC_TASS cookie. At least two threat actors have been observed probing exposed instances and delivering payloads using public PoC code. EMEA financial services running internet-facing NetScaler SAML IDP deployments are at immediate risk of session-token and credential theft via memory disclosure.

2. Regulatory framing

3. Technical analysis & attack chain

Vulnerability details

• CVE: CVE-2026-8451
• CVSS: 8.8 (per verified reference data — no verified reference data was resolved for this item; the CVSS score is sourced from the SecurityWeek/Lupovis report and is single-sourced; verify before enforcement)
• Type: Out-of-bounds read in NetScaler XML parser
• Affected products: NetScaler ADC, NetScaler Gateway
• Prerequisite: Appliance must be configured as SAML IDP
• Authentication required: No — exploitation is unauthenticated
• Patch availability: Citrix released patches on 30 June 2026

Vulnerability mechanism

The bug resides in NetScaler's XML parser. The parser did not terminate unquoted XML attribute values when followed by a newline character. As a result, the parser would read past the intended buffer boundary, and NetScaler would return the overread memory contents in the NSC_TASS cookie within the HTTP response. This is functionally analogous to the original CitrixBleed (CVE-2023-4966) — an information disclosure via memory leakage in an authentication-adjacent component.

Attack chain (confirmed steps from Lupovis reporting)

1. Reconnaissance: Threat actor probes exposed NetScaler instances from a disposable scanning node. Initial activity originated from an IP hosted on infrastructure in Frankfurt, Germany.
2. Endpoint identification: The attacker sends requests to the /saml/login endpoint to identify vulnerable appliances configured as SAML IDP.
3. Payload delivery: Upon receiving a 200 OK response from a vulnerable appliance, the attacker immediately delivers a payload. The payload is a "bare <samlp:AuthnRequest> tag padded with 476 spaces followed by a newline." This matches the overread variant described in watchTowr's detection artefact generator.
4. Memory disclosure: The malformed SAML request triggers the XML parser overread. Memory contents are returned in the NSC_TASS cookie in the HTTP response.
5. Data collection: The attacker retrieves the NSC_TASS cookie value, which contains leaked memory contents from the NetScaler process. This may include session tokens, credentials, or other sensitive in-memory data.

Second threat actor

On the day following the initial exploitation (described as "Thursday"), Lupovis observed a second threat actor probing for exposed NetScaler instances from a Koapu Cloud HK IP address. Both actors demonstrated identical behaviour: probing for the endpoint, receiving a 200 OK, and immediately delivering the payload.

Attribution caveat

No named threat actor group has been identified. Attribution is unconfirmed — Lupovis describes "at least one threat actor" and a "second threat actor" based on IP infrastructure only. No MITRE ATT&CK group profiles are associated. The scanning infrastructure (Frankfurt-hosted IP, Koapu Cloud HK IP) is single-sourced from Lupovis sensor data; verify before enforcement.

Observed impact

• Multiple Lupovis sensors were targeted within a five-hour window.
• A payload was immediately dropped on any sensor that responded with a 200 response.
• No post-exploitation activity (lateral movement, persistence, C2) is described in the source material. The observed impact is limited to memory disclosure via the NSC_TASS cookie.

4. Mitigation & containment

P1 — Within 24 hours

1. Identify exposed appliances: Inventory all NetScaler ADC and NetScaler Gateway instances. Determine which are configured as SAML IDP and which are internet-facing.
2. Block external access to SAML IDP endpoints: If the SAML IDP functionality does not need to be internet-facing, restrict access to /saml/login at the WAF, reverse proxy, or firewall layer. Allow only trusted IdP relay traffic.
3. Inspect logs for exploitation: Search NetScaler logs and any front-end proxy/WAF logs for: - Requests to /saml/login - Request bodies containing <samlp:AuthnRequest> tags with excessive padding (hundreds of spaces) followed by a newline - NSC_TASS cookie values in HTTP responses that appear unusually long or contain non-cookie data (indicating leaked memory)
4. Patch immediately: Apply the Citrix patch released 30 June 2026 to all affected NetScaler appliances. This is the primary remediation.

P2 — Within 72 hours

5. Disable SAML IDP if patching is not possible: If patching cannot be completed within the window, disable SAML IDP configuration on internet-facing NetScaler appliances as a temporary containment measure. This removes the vulnerable code path.
6. Deploy WAF/IPS rules: Create rules to detect and block HTTP requests to /saml/login containing <samlp:AuthnRequest> with abnormal whitespace padding (e.g., >100 consecutive spaces) followed by a newline character.
7. Monitor NSC_TASS cookie responses: Deploy detection logic (SIEM or WAF) to flag HTTP responses where the NSC_TASS cookie value exceeds expected length or contains non-printable/binary data consistent with memory dumps.

P3 — Within 7 days

8. Full patch verification: Confirm all NetScaler appliances across the estate are patched. Verify patch version via the NetScaler admin console or CLI.
9. Post-incident review: If exploitation was confirmed, conduct a full review of potentially leaked memory contents. Assess whether session tokens, credentials, or SAML assertions were exposed. Rotate any credentials or certificates that may have been present in NetScaler process memory.
10. Network segmentation review: Ensure NetScaler appliances are positioned in the network architecture such that SAML IDP endpoints are not unnecessarily exposed to the public internet.

5. Indicators of compromise

http-path  /saml/login
http-cookie  NSC_TASS
payload-pattern  bare <samlp:AuthnRequest> tag padded with 476 spaces followed by a newline
scan-infrastructure  Frankfurt, Germany hosted IP (disposable scanning node)
scan-infrastructure  Koapu Cloud HK IP address

6. Detection

rule NetScaler_CitrixBleed_CVE_2026_8451_Payload {
    meta:
        author = "Adverse Trace"
        date = "2026-07-02"
        reference = "https://www.securityweek.com/new-citrixbleed-vulnerability-exploited-immediately-after-public-disclosure/"
        description = "Detects the SAML AuthnRequest payload with space padding used to exploit CVE-2026-8451 in NetScaler SAML IDP"
    strings:
        $saml_request = "<samlp:AuthnRequest>" ascii
        $newline = "\n" ascii
        $padding = / {20}{400,600}/
    condition:
        $saml_request and $padding and $newline
}

title: Detect CVE-2026-8451 Exp exploitation Attempt Against NetScaler SAML IDP
id: AT-2026-07-02-228-sigma-1
status: experimental
description: Detects HTTP requests to /saml/login containing a padded samlp:AuthnRequest payload consistent with CVE-2026-8451 exploitation
references:

  - https://www.securityweek.com/new-citrixbleed-vulnerability-exploited-immediately-after-public-disclosure/
author: Adverse Trace
date: 2026/07/02
logsource:
    product: webserver
    service: http
detection:
    selection:
        c-uri: "/saml/login*"
        c-uri-query|contains: "<samlp:AuthnRequest>"
    filter_legitimate:
        c-uri-query|re: ".*[ ]{100,}.*\\\\n.*"
    condition: selection and filter_legitimate
fields:

    - src_ip
    - dst_ip
    - c-uri
    - c-useragent
    - http.response.status_code
    - http.response.set_cookie
falsepositives:

    - Legitimate SAML requests with unusual formatting (unlikely given 400+ space padding)
level: high

title: Detect NSC_TASS Cookie Memory Disclosure in HTTP Response
id: AT-2026-07-02-228-sigma-2
status: experimental
description: Detects HTTP responses from NetScaler containing an NSC_TASS cookie with ab long value, indicating potential memory disclosure via CVE-2026-8451
references:

  - https://www.securityweek.com/new-citrixbleed-vulnerability-exploited-immediately-after-public-disclosure/
author: Adverse Trace
date: 2026/07/02
logsource:
    product: webserver
    service: http
detection:
    selection:
        http.response.set_cookie|contains: "NSC_TASS="
    filter_long:
        http.response.set_cookie|re: "NSC_TASS=[^;]{200,}"
    condition: selection and filter_long
fields:

    - src_ip
    - dst_ip
    - http.response.status_code
    - http.response.set_cookie
falsepositives:

    - Legitimate long NSC_TASS cookie values (baseline expected length should be established per environment)
level: medium

7. Sources

• SecurityWeek — "New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure" — https://www.securityweek.com/new-citrixbleed-vulnerability-exploited-immediately-after-public-disclosure/ — 2026-07-02
• SecurityWeek — "Citrix Patches NetScaler Vulnerabilities, Including New 'HTTP/2 Bomb' Attack" — https://www.securityweek.com/citrix-patches-netscaler-vulnerabilities-including-new-http-2-bomb-attack/ — (context only)

8. Adverse Trace position

Severity assessment: HIGH. CVSS 8.8, unauthenticated, actively exploited within 24 hours of disclosure, with public PoC code and a detection artefact generator available. The vulnerability targets authentication infrastructure (SAML IDP) and leaks process memory that may contain session tokens and credentials. The rapid in-the-wild exploitation confirms the ease of exploitation.

Client-impact assessment: EMEA financial services with internet-facing NetScaler ADC or Gateway appliances configured as SAML IDP are at immediate and material risk. The attack requires no authentication, leverages publicly available PoC code, and targets a component that handles federated authentication — a high-value target for financial-sector adversaries. Any client running this configuration should treat this as a P1 incident.

Confidence caveat: The CVSS score (8.8), CVE number (CVE-2026-8451), and exploitation observations are single-sourced from the SecurityWeek/Lupovis report. No verified reference data was resolved for this item. No CISA-KEV listing has been confirmed. Attribution to specific threat actors is unconfirmed — only IP infrastructure (Frankfurt, Koapu Cloud HK) is described, with no MITRE ATT&CK group profiles associated. Verify before enforcement.

Next steps: Adverse Trace will monitor for CISA-KEV addition, additional vendor advisories, and any confirmed post-exploitation activity. We will update this advisory if IOCs beyond the scanning infrastructure are published or if the patch details (specific fixed firmware versions) become available.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.