CISA warns of active exploitation of new NetScaler flaw.

CISA urged agencies to patch CVE‑2026‑8452 after researchers confirmed the NetScaler vulnerability can enable unauthenticated remote code execution on appliances configured as AAA or Gateway VPN servers. Citrix described the flaw as a high‑severity memory overflow, but WatchTowr’s analysis and public PoC showed attackers dropping web shells and running discovery commands shortly after disclosure. The bug was added to the KEV catalog on August 26 with a remediation deadline of August 29, even as Citrix’s advisory has not yet acknowledged active exploitation. It is the second NetScaler issue abused in recent months, following rapid attacks on the CitrixBleed‑like CVE‑2026‑8451.

Read more:

https://www.securityweek.com/recent-citrix-netscaler-vulnerability-exploited-in-the-wild/