Citrix Patches Six Net Scaler Flaws Allowing File Read and Denial-of-Service
Summary: Citrix released security updates on Tuesday for six flaws in NetScaler ADC and NetScaler Gateway that could allow arbitrary file reads or trigger a denial-of-service condition, with patches issued in new versions and customers advised to modify the Http2SmallWndTimeout parameter for CVE-2026-13474. watchTowr Labs said CVE-2026-8451, found in late March 2026 while trying to reproduce the 9.3-rated CVE-2026-3055, stems from how NetScaler parses SAML authentication requests and causes out-of-bounds memory reads on malformed requests, and Lupovis reported active exploitation of CVE-2026-8451 from a Frankfurt IP address (146.70.139[.]154) within 24 hours of public disclosure.
What's compelling: Lupovis observed an attacker validating targets and delivering the full payload only when sensors returned 200 OK, using an exploit matching watchTowr's release - active exploitation inside 24 hours of disclosure, against an appliance class that has previously been used for ransomware deployment.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-13474CVE-2026-3055CVE-2026-8451
- Related
- CVE-2026-3055: Citrix Net Scaler Out-of-Bounds Read Vulnerability Known Exploited Vulnerabilities · Mar 30, 2026