Citrix NetScaler appliances are currently facing significant threats due to the rapid exploitation of a newly disclosed memory disclosure vulnerability, CVE-2026-8451, which is part of the evolving “CitrixBleed” class.
This high-severity flaw (CVSS 8.8), disclosed on June 30, 2026, in Citrix advisory CTX696604, was observed being exploited in the wild within just 24 hours of its announcement, indicating a shrinking window between vulnerability disclosure and active exploitation.
CitrixBleed Vulnerability Exploitation
Security researchers from Lupovis confirmed a coordinated scanning and exploitation campaign specifically targeting NetScaler devices configured as SAML Identity Providers. While this is a non-default configuration, it is frequently used in enterprise environments.
The vulnerability lies in NetScaler’s custom XML parser, which handles SAML AuthnRequest messages. Improper handling of unquoted XML attribute values that are followed by newline characters results in a memory overrun.
This allows attackers to retrieve sensitive memory contents through the NSC_TASS cookie in HTTP responses. Notably, exploitation does not require authentication, making systems exposed to the internet particularly vulnerable. The affected versions include NetScaler ADC and Gateway 14.1 before 14.1-72.61, and 13.1 before 13.1-63.18.
Lupovis telemetry revealed that a single threat actor operating from the IP address 146.70.139.154, associated with AS9009 (M247 Europe SRL), conducted a structured sweep across multiple decoy sensors within a five-hour window.
The attacker utilized automated tools identified by the user-agent string “python-requests/2.32.5” and followed a consistent probing methodology.
Initial requests returned HTTP 404 responses, but once a valid HTTP 200 response was received from a high-fidelity decoy, the actor immediately delivered a complete exploitation payload targeting the POST /saml/login endpoint.
The payload is highly distinctive and aligns with a proof-of-concept Detection Artifact Generator released by watchTowr Labs on the same day as the vulnerability’s disclosure.
It features a base64-encoded SAMLRequest that decodes into a malformed tag padded with hundreds of whitespace characters, followed by a newline, intentionally triggering the parser to overrun. This specific structure confirms that the exploitation was targeted rather than a result of generic scanning.
This campaign highlights the growing importance of detection accuracy in defensive environments. Lupovis observed that only sensors mimicking legitimate application behavior successfully captured the full exploit payload. At the same time, low-interaction decoys recorded only reconnaissance activity.
This indicates that attackers are increasingly validating their targets before committing to exploitation, thereby reducing noise and improving efficiency.
Importantly, CVE-2026-8451 has not yet been added to the CISA’s Known Exploited Vulnerabilities (KEV) catalog, leaving organizations that rely solely on KEV-based prioritization vulnerable during the early phases of attacks. Indicators of compromise include repeated POST requests to /saml/login.
| Indicator | Type | Context |
| 146.70.139.154 | IPv4 | CVE-2026-8451 scanning, M247 Europe SRL exit node (AS9009), Germany |
| python-requests/2.32.5 | User-Agent | Automated scanning tooling |
| POST /saml/login | Endpoint | CVE-2026-8451 exploit endpoint |
| <samlp:AuthnRequest + 400+ spaces | Payload pattern | CVE-2026-8451 overread variant |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
These base64-encoded SAMLRequest values resolve to whitespace-padded AuthnRequest tags, and unusual NSC_TASS cookie values containing binary data.
Security teams are strongly advised to patch affected systems immediately or turn off SAML IdP functionality if patching is not feasible.
Additionally, organizations should review logs dating back to June 30, 2026, monitor for suspicious SAML traffic patterns, and block known malicious infrastructure as necessary, being aware that attacker IPs may change quickly.
Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN
