Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

Active Exploitation of CVE-2026-8451 in Citrix NetScaler ADC and NetScaler Gateway

Successful exploitation of CVE-2026-8451 could allow unauthenticated memory disclosure in NetScaler appliances when configured as a SAML IDP.

Threat ID:
CC-4805
Threat Severity:
Medium
Published:
1 July 2026 2:19 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Successful exploitation of CVE-2026-8451 could allow unauthenticated memory disclosure in NetScaler appliances when configured as a SAML IDP.

Threat details

Active Exploitation of CVE-2026-8451

Following the release of a public proof-of-concept exploit, security researchers have reported observing exploitation attempts of CVE-2026-8451.

The NHS England National CSOC assesses further exploitation as almost certain.

Introduction

Citrix has released a security advisory to address a high severity vulnerability in NetScaler ADC and NetScaler Gateway. Successful exploitation could allow an unauthenticated attacker to achieve memory disclosure in NetScaler appliances when configured as a SAML IDP.

  • CVE-2026-8451 – Out-of-bounds Read (CWE-125) – CVSSv4 score: 8.8.

Threat updates

Date Update
3 Jul 2026 Active Exploitation of CVE-2026-8451

The following sections have been updated to reflect exploitation of CVE-2026-8451:

  • Title
  • Emphasis Box

Remediation advice

Affected organisations are encouraged to review Citrix advisory CTX696604 and apply the relevant update as soon as possible.

Last edited: 3 July 2026 10:24 am