CISA Warns of Actively Exploited Citrix NetScaler ADC and Gateway Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-8452, a vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway appliances, to its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation.

This vulnerability was added on August 26, 2026, and federal civilian agencies are required to apply vendor-recommended mitigations by August 29, 2026.

Citrix NetScaler ADC and Gateway Vulnerability

CVE-2026-8452 is classified as an improper restriction of operations within the bounds of a memory buffer issue, which is tracked as CWE-119.

According to CISA, this vulnerability could enable a denial-of-service condition in affected NetScaler ADC and NetScaler Gateway deployments.

NetScaler appliances are commonly deployed at the network edge to provide application delivery, load balancing, remote access, and secure gateway capabilities.

Therefore, vulnerabilities affecting internet-facing instances can pose significant operational risks, especially when these devices support VPN connectivity, authentication workflows, or access to critical enterprise applications.

CISA’s KEV entry does not specify whether CVE-2026-8452 has been used in ransomware campaigns, marking that status as unknown. The agency also indicated that forensic triage is not required under Binding Operational Directive 26-04 for this vulnerability.

However, the absence of a mandatory forensic triage requirement should not be interpreted as a low-risk designation. Organizations must identify all exposed NetScaler ADC and Gateway assets, verify their version and patch status, and consult Citrix’s vendor guidance for available fixes or mitigations.

Internet-facing appliances should be prioritized since attackers frequently target edge infrastructure for initial access, service disruption, credential theft, and subsequent lateral movement.

CISA has directed federal agencies to implement mitigations in accordance with vendor instructions and BOD 26-04, which prioritizes security updates based on risk.

Agencies and other organizations should also evaluate whether vulnerable systems are externally accessible and discontinue use of affected products if effective mitigations are unavailable.

Security teams should monitor NetScaler-related logs for abnormal request patterns, repeated service failures, unexpected appliance restarts, and spikes in traffic that could indicate attempted denial-of-service activity.

Network defenders should ensure that administrative interfaces are not publicly exposed unless necessary, restrict management access to trusted networks, and maintain tested recovery procedures for critical gateway infrastructure.

Given that CVE-2026-8452 is included in CISA’s KEV Catalog, rapid remediation is essential for organizations operating Citrix NetScaler infrastructure.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC