Citrix patches NetScaler after exploited high severity leak

Citrix has released a critical security update for its NetScaler ADC and NetScaler Gateway appliances, patching six vulnerabilities, including a new high-severity memory leak flaw that has already been exploited in the wild. The company issued the patches on June 30, and cybersecurity researchers observed active exploitation attempts beginning less than 24 hours later.

The most notable vulnerability, tracked as CVE-2026-8451 with a CVSS score of 8.8, is described as an out-of-bounds read issue. It allows unauthenticated attackers to leak small amounts of protected memory data from a vulnerable appliance. The flaw exists in NetScaler's XML parser and is triggered when the appliance is configured as a SAML Identity Provider, a common setup for single sign-on. Security firm watchTowr, which discovered the flaw, published a detailed technical analysis alongside the patch release.

While the data leak is smaller than in previous, related vulnerabilities collectively known as "CitrixBleed," researchers warn it is still dangerous. The exposed information could include memory pointers that, if combined with a separate memory corruption flaw, could help attackers bypass security defenses...