Detect CVE-2026-8452: Citrix NetScaler ADC/Gateway Memory Buffer Overflow Exploitation in Elastic Security
Detects exploitation attempts and post-exploitation activity targeting CVE-2026-8452, an improper restriction of operations within the bounds of a memory buffer (CWE-119) vulnerability in Citrix NetScaler ADC and NetScaler Gateway. This CVE is listed in the CISA KEV catalog, indicating confirmed in-the-wild exploitation. The flaw allows attackers to overflow a memory buffer via crafted requests to exposed NetScaler management or gateway (VPN/AAA) endpoints, potentially leading to memory disclosure, denial of service, or remote code execution. Detection focuses on anomalous requests to NetScaler endpoints, abnormal appliance process behavior (nsppe/nsaaad crashes, shell spawns), and outbound connections from the appliance indicative of webshell or reverse-shell deployment.
MITRE ATT&CK
- Tactic
- Initial Access Execution
Elastic Detection Query
sequence by source.ip with maxspan=10m
[ network where destination.port in (443, 80) and
(url.path : ("/vpn/*", "/nsgw/*", "/logon/LogonPoint*", "/pcidss/report*", "/gwtest/formssso*") or
url.original : ("*..%2f*", "*%00*")) ] with runs=15EQL sequence detecting a burst of requests to Citrix NetScaler vulnerable endpoints with traversal/null-byte encodings indicative of CVE-2026-8452 memory-buffer exploitation from a single source.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate VPN reconnection storms after outages
- Vulnerability scanners authorized on the network
- Monitoring probes generating repeated gateway requests
Other platforms for CVE-2026-8452
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated malformed NetScaler gateway request with path traversal
Expected signal: Proxy/firewall log entry with oversized POST body and '..%2f' in the URL to a NetScaler VIP
- Test 2Burst of gateway logon requests from single source
Expected signal: 20 HTTP GET requests to /logon/LogonPoint within a 10-minute window from one source IP
- Test 3Simulated post-exploitation shell spawn from appliance process
Expected signal: ProcessRollup2 event: parent nsppe spawning sh/curl child processes
References (4)
- https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-8452
Response Playbook
Triage
- Confirm whether the destination appliance is a Citrix NetScaler ADC or Gateway and identify its firmware build; cross-check against Citrix advisory CTX696604 to determine if it is a version affected by CVE-2026-8452.
- Review the source IP(s) generating the flagged requests — determine if they are internal, known scanners, or unfamiliar external hosts, and check threat-intel reputation.
- Examine the specific request URLs and payloads for path traversal (..%2f), null bytes (%00), or oversized request bodies that indicate a buffer-overflow attempt rather than benign traffic.
- Check the NetScaler ns.log and shell history for crashes of nsppe/nsaaad, core dumps, or unexpected process launches around the time of the alert.
Containment
- If exploitation is confirmed or strongly suspected, restrict external access to the NetScaler management and gateway endpoints via firewall/ACL and block the offending source IP(s).
- Apply the vendor fix from Citrix advisory CTX696604 (upgrade to the patched NetScaler build) as a priority per CISA BOD 26-04, or take the appliance offline if patching cannot be immediate.
- Rotate any credentials, session tokens, and TLS/appliance secrets that may have been exposed through memory disclosure on the compromised appliance.
Evidence Collection
- Capture NetScaler ns.log, shell.log, bash history, and any core/crash dumps from /var/core for forensic analysis.
- Preserve proxy, firewall, and packet-capture data showing the malicious requests and any subsequent outbound connections from the appliance.
- Export a snapshot/backup of the appliance filesystem to identify webshells or modified files (e.g., under /netscaler/ns_gui/).
Escalation Criteria
- !Escalate to incident response immediately if evidence of successful exploitation is found — webshell files, spawned shells, or outbound C2 connections from the appliance.
- !Escalate if memory disclosure indicators suggest credential or session-token theft, requiring broader credential rotation and hunting for lateral movement.
- !Escalate to management and comply with CISA BOD 26-04 reporting/remediation timelines given the KEV listing.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
NetScaler ns.log and shell.log entries showing nsppe/nsaaad crashes or unexpected commands - >
Core/crash dump files under /var/core - >
New or modified files under /netscaler/ns_gui/ (potential webshells) - >
Unexpected outbound network connections originating from the appliance management IP
Tuning Guidance
Populate the netscalerIPs/dest_category filters with your actual NetScaler management and VIP addresses to reduce noise. Baseline normal VPN logon volume per source and adjust the request-count threshold (default 15/10m) accordingly. Whitelist authorized vulnerability scanners and monitoring probes by source IP. Prioritize the malformed-URL and appliance-crash signals over pure volume, as legitimate logon surges can inflate counts.
Hunting Queries
Hunts for malformed requests and appliance crash indicators across NetScaler and proxy logs that may correspond to CVE-2026-8452 exploitation not caught by the volume threshold.
CommonSecurityLog | where DeviceVendor =~ "Citrix" | where RequestURL contains "..%2f" or RequestURL contains "%00" or DestinationPort == 443 | summarize count() by SourceIP, RequestURL, bin(TimeGenerated, 1h) | where count_ > 5index=netscaler ("..%2f" OR "%00" OR "nsppe" OR "core dump") | stats count values(url) as urls by host, src_ip | where count > 3Atomic Red Team Tests
Sends an HTTP request containing path-traversal and null-byte encodings to a lab NetScaler gateway endpoint to generate proxy/appliance telemetry matching the detection.
Command
curl -sk 'https://netscaler-lab.internal/vpn/../vpns/cfg/smb.conf' -H 'User-Agent: overflow-test' --data-binary @<(python3 -c "print('A'*4096)") -o /dev/nullCleanup
echo 'No cleanup required; request is read-only test traffic'Expected Telemetry
Proxy/firewall log entry with oversized POST body and '..%2f' in the URL to a NetScaler VIP
Expected Detection
KQL/SPL volume+malformed detection flags the request due to traversal/oversized body
Generates a rapid burst of requests to the NetScaler LogonPoint endpoint to trigger the volume-based buffer-overflow attempt heuristic.
Command
for i in $(seq 1 20); do curl -sk 'https://netscaler-lab.internal/logon/LogonPoint/tmindex.html' -o /dev/null; doneCleanup
echo 'No cleanup required'Expected Telemetry
20 HTTP GET requests to /logon/LogonPoint within a 10-minute window from one source IP
Expected Detection
Volume threshold (>15 requests/10m) trips the KQL/SPL/EQL correlation rules
On a lab host, simulates a NetScaler appliance process (renamed parent) spawning a shell to validate the CrowdStrike CQL post-exploitation detection.
Command
cp /bin/bash /tmp/nsppe && /tmp/nsppe -c '/bin/sh -c "id; curl -sk http://127.0.0.1/ -o /dev/null"'Cleanup
rm -f /tmp/nsppeExpected Telemetry
ProcessRollup2 event: parent nsppe spawning sh/curl child processes
Expected Detection
CrowdStrike CQL rule flags shell/network-tool child of nsppe-named parent process