Citrix · NetScaler ADC and NetScaler Gateway
CVE-2026-8452
Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service
Qué es
Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server
CISA: Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service.
Qué hacer
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Plazo para las agencias federales de EE. UU.: 29 de agosto de 2026
- Añadida a la lista de CISA
- 26 de agosto de 2026
- Publicada
- 30 de junio de 2026
- Gravedad
- Alto 8,8 CVSS 4.0
- Probabilidad de ataques en los próximos 30 días (EPSS)
- 1,0% entre el 37,0% superior de todas las vulnerabilidades conocidas
- Debilidad
- CWE-119
- Más detalles
- NVD · CVE.org · CISA
Todas las referencias (1)
Más fallos explotados de Citrix
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 17 ene 2024 | Code Injection | NetScaler ADC and NetScaler Gateway | Media 5,5 | 3,2% |
| 17 ene 2024 | Buffer Overflow | NetScaler ADC and NetScaler Gateway | Alto 8,2 | 58% |
| 18 oct 2023 | Buffer Overflow | NetScaler ADC and NetScaler Gateway | Crítica 9,4 | >99,9% |
| 19 jul 2023 | Code Injection | NetScaler ADC and NetScaler Gateway | Crítica 9,8 | 99,7% |
| 4 oct 2026 | Improper Restriction of Operations within the Bounds of a Memory Buffer | NetScaler | Alto 8,7 | 11% |
| 27 sept 2026 | Improper Input Validation | NetScaler | Crítica 9,5 | 82% |
| 27 sept 2026 | Improper Restriction of Operations within the Bounds of a Memory Buffer | NetScaler | Crítica 9,5 | 78% |
| 9 sept 2026 | Authentication Bypass Using an Alternate Path or Channel | NetScaler | Crítica 9,3 | 33% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.