CVE-2026-8451 is an out-of-bounds read vulnerability affecting Citrix NetScaler ADC and Gateway appliances configured as SAML Identity Providers. The issue arises from the XML parser not terminating unquoted XML attribute values when followed by a newline character, leading to reading beyond the intended buffer. This results in memory contents being disclosed in the NSC_TASS cookie within HTTP responses. The vulnerability requires no authentication for exploitation. Public proof-of-concept code was released on June 30, 2026, and attackers began exploiting the flaw within 24 hours, scanning for exposed NetScaler instances and delivering payloads that trigger the memory disclosure. The vulnerability has a CVSS score of 8.8. Citrix released patches concurrently with the disclosure. Detection can be performed by inspecting /saml/login traffic and NSC_TASS cookie values.

Successful exploitation of this vulnerability allows unauthenticated attackers to retrieve arbitrary memory content from affected NetScaler appliances configured as SAML IDP. This memory disclosure can expose sensitive information, potentially leading to further compromise or data leakage. The vulnerability affects the confidentiality of data processed by the appliance. Exploitation has been observed in the wild shortly after public disclosure.

Citrix has released official patches for this vulnerability; organizations should apply these patches immediately. If patching is not possible, disabling the SAML IDP configuration on NetScaler appliances is recommended to mitigate risk. Additionally, organizations should monitor logs for /saml/login traffic, inspect request values, and check NSC_TASS cookie values for signs of exploitation. These steps align with vendor guidance and observed attack patterns.