ExploitPublished 2 Jul 2026

New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure

Source SecurityWeek

Mentioned vulnerabilities

CVE-2026-8451

Severity

Medium

Rated by Threat Radar

Data as of 6 Jul 2026, 00:34 UTC

What to do

AI-suggested

Citrix has released official patches for this vulnerability; organizations should apply these patches immediately. If patching is not possible, disabling the SAML IDP configuration on NetScaler appliances is recommended to mitigate risk. Additionally, organizations should monitor logs for /saml/login traffic, inspect request values, and check NSC_TASS cookie values for signs of exploitation. These steps align with vendor guidance and observed attack patterns.

Description

Hackers are targeting NetScaler appliances using public PoC code to retrieve arbitrary memory content in the HTTP response. The post New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure appeared first on SecurityWeek .

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to retrieve arbitrary memory content from affected NetScaler appliances configured as SAML IDP. This memory disclosure can expose sensitive information, potentially leading to further compromise or data leakage. The vulnerability affects the confidentiality of data processed by the appliance. Exploitation has been observed in the wild shortly after public disclosure.

Summary

CVE-2026-8451 is an out-of-bounds read vulnerability affecting Citrix NetScaler ADC and Gateway appliances configured as SAML Identity Providers. The issue arises from the XML parser not terminating unquoted XML attribute values when followed by a newline character, leading to reading beyond the intended buffer. This results in memory contents being disclosed in the NSC_TASS cookie within HTTP responses. The vulnerability requires no authentication for exploitation. Public proof-of-concept code was released on June 30, 2026, and attackers began exploiting the flaw within 24 hours, scanning for exposed NetScaler instances and delivering payloads that trigger the memory disclosure. The vulnerability has a CVSS score of 8.8. Citrix released patches concurrently with the disclosure. Detection can be performed by inspecting /saml/login traffic and NSC_TASS cookie values.

References

securityweek.com/new-citrixbleed-vulnerability-exploited-immediately-after-public-disclosure/ (opens in a new tab)

Community reviews

Loading reviews…

What to do

Description

AI analysisMachine-generated, updated 2 Jul 2026, 15:06 UTC

References

Community reviews

Related threats