CVE-2026-8452

CVE-2026-8452: Citrix NetScaler ADC/Gateway Memory Buffer Overflow Exploitation

Initial Access Execution Last updated:

Detects exploitation attempts and post-exploitation activity targeting CVE-2026-8452, an improper restriction of operations within the bounds of a memory buffer (CWE-119) vulnerability in Citrix NetScaler ADC and NetScaler Gateway. This CVE is listed in the CISA KEV catalog, indicating confirmed in-the-wild exploitation. The flaw allows attackers to overflow a memory buffer via crafted requests to exposed NetScaler management or gateway (VPN/AAA) endpoints, potentially leading to memory disclosure, denial of service, or remote code execution. Detection focuses on anomalous requests to NetScaler endpoints, abnormal appliance process behavior (nsppe/nsaaad crashes, shell spawns), and outbound connections from the appliance indicative of webshell or reverse-shell deployment.

Vulnerability Intelligence

KEV — Known Exploited

Affected Software

Vendor
Citrix
Product
NetScaler ADC and NetScaler Gateway

Weakness (CWE)

CWE-119

Timeline

Disclosed
August 26, 2026

CVSS

Unscored
CVSS vector not yet published
Write-up coming soon

What is CVE-2026-8452 CVE-2026-8452: Citrix NetScaler ADC/Gateway Memory Buffer Overflow Exploitation?

CVE-2026-8452: Citrix NetScaler ADC/Gateway Memory Buffer Overflow Exploitation (CVE-2026-8452) maps to the Initial Access and Execution tactics — the adversary is trying to get into your network in MITRE ATT&CK.

This page provides production-ready detection logic for CVE-2026-8452: Citrix NetScaler ADC/Gateway Memory Buffer Overflow Exploitation, covering the data sources and telemetry it touches: Web Proxy Logs, Firewall Logs, Citrix NetScaler Syslog. The queries below are rated critical severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Initial Access Execution
Microsoft Sentinel / Defender
kusto 
let netscalerIPs = dynamic(["10.0.0.0"]); // Tune: replace with NetScaler ADC/Gateway management + VIP addresses
let exploitPaths = dynamic(["/vpn/", "/nsgw/", "/logon/LogonPoint", "/nCC/", "/pcidss/report", "/menu/ss", "/menu/neo", "/menu/stapp", "/gwtest/formssso"]);
CommonSecurityLog
| where DeviceVendor =~ "Citrix" or DestinationIP in (netscalerIPs)
| where isnotempty(RequestURL)
| where RequestURL has_any (exploitPaths) or RequestURL contains "..%2f" or RequestURL contains "%00"
| extend BodyLen = toint(column_ifexists("RequestClientApplication", ""))
| where RequestMethod in ("POST", "GET")
| summarize RequestCount = count(), Paths = make_set(RequestURL, 20), Methods = make_set(RequestMethod, 5) by SourceIP, DestinationIP, bin(TimeGenerated, 10m)
| where RequestCount > 15
| project TimeGenerated, SourceIP, DestinationIP, RequestCount, Paths, Methods
| order by RequestCount desc

Identifies high-volume or malformed HTTP requests to Citrix NetScaler VPN/Gateway/management endpoints consistent with buffer-overflow exploitation of CVE-2026-8452. Flags path traversal and null-byte encodings often used to reach vulnerable handlers.

critical severity medium confidence

Data Sources

Web Proxy Logs Firewall Logs Citrix NetScaler Syslog

Required Tables

CommonSecurityLog

False Positives

  • Legitimate high-volume VPN logon activity during shift changes or mass reconnection events after appliance restart
  • Vulnerability scanners and authorized penetration tests probing NetScaler endpoints
  • Load balancer health checks or monitoring probes hitting gateway paths frequently

Sigma rule & cross-platform mapping

The detection logic for CVE-2026-8452: Citrix NetScaler ADC/Gateway Memory Buffer Overflow Exploitation (CVE-2026-8452) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: network_connection
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for CVE-2026-8452 Sigma rules on detection.fyi

Platform-specific guides for CVE-2026-8452

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-08-27 Research depth: standard
References (4)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulated malformed NetScaler gateway request with path traversal

    Expected signal: Proxy/firewall log entry with oversized POST body and '..%2f' in the URL to a NetScaler VIP

  2. Test 2Burst of gateway logon requests from single source

    Expected signal: 20 HTTP GET requests to /logon/LogonPoint within a 10-minute window from one source IP

  3. Test 3Simulated post-exploitation shell spawn from appliance process

    Expected signal: ProcessRollup2 event: parent nsppe spawning sh/curl child processes

Response Playbook

Triage

  1. Confirm whether the destination appliance is a Citrix NetScaler ADC or Gateway and identify its firmware build; cross-check against Citrix advisory CTX696604 to determine if it is a version affected by CVE-2026-8452.
  2. Review the source IP(s) generating the flagged requests — determine if they are internal, known scanners, or unfamiliar external hosts, and check threat-intel reputation.
  3. Examine the specific request URLs and payloads for path traversal (..%2f), null bytes (%00), or oversized request bodies that indicate a buffer-overflow attempt rather than benign traffic.
  4. Check the NetScaler ns.log and shell history for crashes of nsppe/nsaaad, core dumps, or unexpected process launches around the time of the alert.

Containment

  1. If exploitation is confirmed or strongly suspected, restrict external access to the NetScaler management and gateway endpoints via firewall/ACL and block the offending source IP(s).
  2. Apply the vendor fix from Citrix advisory CTX696604 (upgrade to the patched NetScaler build) as a priority per CISA BOD 26-04, or take the appliance offline if patching cannot be immediate.
  3. Rotate any credentials, session tokens, and TLS/appliance secrets that may have been exposed through memory disclosure on the compromised appliance.

Evidence Collection

  1. Capture NetScaler ns.log, shell.log, bash history, and any core/crash dumps from /var/core for forensic analysis.
  2. Preserve proxy, firewall, and packet-capture data showing the malicious requests and any subsequent outbound connections from the appliance.
  3. Export a snapshot/backup of the appliance filesystem to identify webshells or modified files (e.g., under /netscaler/ns_gui/).

Escalation Criteria

  • ! Escalate to incident response immediately if evidence of successful exploitation is found — webshell files, spawned shells, or outbound C2 connections from the appliance.
  • ! Escalate if memory disclosure indicators suggest credential or session-token theft, requiring broader credential rotation and hunting for lateral movement.
  • ! Escalate to management and comply with CISA BOD 26-04 reporting/remediation timelines given the KEV listing.

Investigation Guide

Forensic Artifacts

  • > NetScaler ns.log and shell.log entries showing nsppe/nsaaad crashes or unexpected commands
  • > Core/crash dump files under /var/core
  • > New or modified files under /netscaler/ns_gui/ (potential webshells)
  • > Unexpected outbound network connections originating from the appliance management IP

Tuning Guidance

Populate the netscalerIPs/dest_category filters with your actual NetScaler management and VIP addresses to reduce noise. Baseline normal VPN logon volume per source and adjust the request-count threshold (default 15/10m) accordingly. Whitelist authorized vulnerability scanners and monitoring probes by source IP. Prioritize the malformed-URL and appliance-crash signals over pure volume, as legitimate logon surges can inflate counts.

Hunting Queries

Hunts for malformed requests and appliance crash indicators across NetScaler and proxy logs that may correspond to CVE-2026-8452 exploitation not caught by the volume threshold.

Hunting — KQL
kql 
CommonSecurityLog | where DeviceVendor =~ "Citrix" | where RequestURL contains "..%2f" or RequestURL contains "%00" or DestinationPort == 443 | summarize count() by SourceIP, RequestURL, bin(TimeGenerated, 1h) | where count_ > 5
Hunting — SPL
spl 
index=netscaler ("..%2f" OR "%00" OR "nsppe" OR "core dump") | stats count values(url) as urls by host, src_ip | where count > 3

Atomic Red Team Tests

Test 1 Simulated malformed NetScaler gateway request with path traversal
linux

Sends an HTTP request containing path-traversal and null-byte encodings to a lab NetScaler gateway endpoint to generate proxy/appliance telemetry matching the detection.

Command

bash 
curl -sk 'https://netscaler-lab.internal/vpn/../vpns/cfg/smb.conf' -H 'User-Agent: overflow-test' --data-binary @<(python3 -c "print('A'*4096)") -o /dev/null

Cleanup

bash 
echo 'No cleanup required; request is read-only test traffic'

Expected Telemetry

Proxy/firewall log entry with oversized POST body and '..%2f' in the URL to a NetScaler VIP

Expected Detection

KQL/SPL volume+malformed detection flags the request due to traversal/oversized body

Test 2 Burst of gateway logon requests from single source
linux

Generates a rapid burst of requests to the NetScaler LogonPoint endpoint to trigger the volume-based buffer-overflow attempt heuristic.

Command

bash 
for i in $(seq 1 20); do curl -sk 'https://netscaler-lab.internal/logon/LogonPoint/tmindex.html' -o /dev/null; done

Cleanup

bash 
echo 'No cleanup required'

Expected Telemetry

20 HTTP GET requests to /logon/LogonPoint within a 10-minute window from one source IP

Expected Detection

Volume threshold (>15 requests/10m) trips the KQL/SPL/EQL correlation rules

Test 3 Simulated post-exploitation shell spawn from appliance process
linux

On a lab host, simulates a NetScaler appliance process (renamed parent) spawning a shell to validate the CrowdStrike CQL post-exploitation detection.

Command

bash 
cp /bin/bash /tmp/nsppe && /tmp/nsppe -c '/bin/sh -c "id; curl -sk http://127.0.0.1/ -o /dev/null"'

Cleanup

bash 
rm -f /tmp/nsppe

Expected Telemetry

ProcessRollup2 event: parent nsppe spawning sh/curl child processes

Expected Detection

CrowdStrike CQL rule flags shell/network-tool child of nsppe-named parent process

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002Execution

Related Techniques

T1190Exploit Public-Facing ApplicationT1505.003Web ShellT1499Endpoint Denial of Service

Same Tactic: Initial Access

Popular Detections