CVE-2026-8452

An unauthenticated attacker can execute arbitrary code as root on Citrix NetScaler ADC and Gateway appliances via CVE-2026-8452.

This memory buffer overflow allows remote code execution without authentication, enabling attackers to fully compromise the appliance. DIB organizations must immediately patch affected versions (14.1, 13.1, 14.1 FIPS, 13.1 FIPS) and monitor for exploitation, as the flaw is actively exploited in the wild and the PoC is publicly available.

Shame score — A critical RCE flaw in a widely deployed network appliance was actively exploited in the wild with a publicly available PoC, indicating severe negligence in patching and vulnerability management.