The short answer
- Affected
- NetScaler ADC and NetScaler Gateway builds below the first fixed build for their release, when the precondition below is met.
- Fixed in
- 14.1-72.61 / 13.1-63.18First fixed builds for 14.1 / 13.1. All releases in the table below.
- Current safe build
- 14.1-73.46 / 13.1-64.29Includes later fixes. Advisory data as of 2026-10-15.
- CISA KEV
- Added 2026-08-26, federal due date 2026-08-29. Known ransomware use: Unknown.
- Forensic triage
- No forensic triage flag on this KEV entry.
- CVSS
- 8.8 (CVSS v4.0, vendor score in CTX696604)
- Preconditions
- Configured as Gateway or AAA virtual server
- Session kill advised
- No. The bulletin does not call for session termination.
Fixed builds from the Citrix® security bulletin CTX696604
| Release | First fixed build | Current safe build |
|---|---|---|
| NetScaler 14.1 | 14.1-72.61 | 14.1-73.46 |
| NetScaler 14.1 FIPS | 14.1-72.61 FIPS | 14.1-73.46 FIPS |
| NetScaler 13.1Past end of maintenance | 13.1-63.18 | 13.1-64.29 |
| NetScaler 13.1 FIPS/NDcPPPast end of maintenance | 13.1-37.272 FIPS | 13.1-37.283 FIPS |
FIPS and NDcPP builds have separate fixed builds: see the table and the bulletin.
What it is
“Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability”
Our advisory data, taken from CTX696604, summarises it as: Memory overflow (vendor: DoS; watchTowr: pre-auth root RCE). Vulnerability class: memory overflow (CWE-119). Precondition: Configured as Gateway or AAA virtual server.
For the full description, read the CVE.org record for CVE-2026-8452 and the vendor bulletin.
Am I affected?
Two things must both be true: the appliance runs a build below the fixed build for its release (see the table above), and its configuration meets the precondition: Configured as Gateway or AAA virtual server. Find the build with show ns version on the CLI.
Enter your build to check it against CVE-2026-8452 and every other NetScaler CVE in our data. The checker runs in your browser and never connects to any appliance.
Open the checker with CVE-2026-8452 highlightedHow to patch
- Choose the target build: at least
14.1-72.61on 14.1 or13.1-63.18on 13.1. Prefer the current safe build (14.1-73.46 / 13.1-64.29), which also includes later fixes. FIPS and NDcPP appliances need their own fixed build from the table above. - Upgrade every node. In an HA pair, upgrade the secondary first, fail over, then upgrade the former primary. Our HA pair upgrade runbook walks through each step and the rollback.
- Confirm the build on each node with
show ns version, then work through the post-patch steps below.
13.1 is past end of maintenance, so plan the move to 14.1 while you are in the change window. Check the release dates in our NetScaler end-of-life guide.
After patching
Steps in the vendor bulletin
vendor bulletinThe bulletin does not call for session termination. It lists no post-patch steps beyond the upgrade.
Configuration changes for other CVEs in CTX696604
CVE-2026-13474: set the HTTP/2 small-window timeout on every non-strict HTTP profile with HTTP/2 enabled
set ns httpProfile <profile> -http2SmallWndTimeout 30Upgrading alone does not fix CVE-2026-13474. Settings on nshttp_default_profile are inherited by everything.
Hunt for compromise
Upgrading does not remove an existing compromise. These indicators and tools are published guidance; we do not run them for you.
CVE-2026-8452 spray-and-pray webshells
- x.php
- z.php under the Gateway web root
Tools: watchTowr CVE-2026-8452 write-up
Source: watchTowr
Timeline
- Vendor bulletin CTX696604 published with fixed builds
- Added to the CISA Known Exploited Vulnerabilities catalog
- CISA federal remediation due date
Related CVEs
- CVE-2026-8451SAML IdP memory overreadNot in KEVSame bulletin (CTX696604)
- CVE-2026-8655Memory overflows in Oracle LB, DNS proxy and resolverNot in KEVSame bulletin (CTX696604)
- CVE-2026-10816Unauthenticated file read on the management interfaceNot in KEVSame bulletin (CTX696604)
- CVE-2026-10817Memory overread via the TCP timestamp optionNot in KEVSame bulletin (CTX696604)
- CVE-2026-13474HTTP/2 denial of service (needs a config change as well as the upgrade)Not in KEVSame bulletin (CTX696604)
Sources
- Vendor bulletin: CTX696604, NetScaler ADC and Gateway security bulletin for six CVEs (June 2026) (published 2026-06-30)
- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-8452
- CISA KEV catalog JSON feed, version 2026.10.15: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Last verified 2026-10-15 against CISA KEV and CVE.org. Advisory data version 2026.10.15-1.