{"active":true,"category":"Vulnerability/CVE","confidence":"MEDIUM","confidence_reason":"Daily security news, consistently strong on exploitation-in-the-wild reporting. filter_uncategorized drops vendor-marketing and roundup filler.","key_points":["FLAW -- CVE-2026-8452 (CVSS 8.8) is a heap overflow in Citrix NetScaler ADC/Gateway's SAML SSO message parsing, network-reachable with no authentication or user interaction required.","PATCH GAP -- Citrix shipped the fix June 30, 2026 (14.1-72.61+, 13.1-63.18+) describing it as a denial-of-service bug; watchTowr Labs' August 14 proof-of-concept showed it actually chains into full unauthenticated remote code execution, which is why unpatched appliances are now under active attack.","EXPLOITATION -- Previdian and Defused telemetry, reported by The Hacker News, found 36 exploitation attempts from 12 unique attacker IPs over 12 days, with attackers dropping x.php/z.php web shells and running id/echo discovery commands on compromised appliances.","EXPOSURE -- Shadowserver data reported by BleepingComputer counts over 22,000 NetScaler ADC appliances and nearly 1,800 Gateway instances still reachable from the internet as of August 27-28, indicating widespread unpatched exposure even as the federal deadline arrives.","SCOPE -- Exploitable only where NetScaler is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server; CISA's KEV addition bundled five other actively exploited flaws (Microsoft SQL Server, Linux Kernel, two Red Hat components, Ajax.NET Professional) in the same August 26 batch."],"published_at":"2026-08-27","source_name":"Help Net Security","summary":"CISA's federal remediation deadline for CVE-2026-8452, a Citrix NetScaler ADC/Gateway memory-corruption flaw in SAML message parsing, lands today, August 29, three days after the agency added it to its Known Exploited Vulnerabilities catalog on August 26. Citrix patched the CVSS 8.8 flaw on June 30 (versions 14.1-72.61 and 13.1-63.18+), describing it only as a denial-of-service issue, but watchTowr Labs published a proof-of-concept on August 14 showing the unauthenticated, network-reachable heap overflow chains into full remote code execution on appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Security firms Previdian (formerly KEVIntel) and Defused subsequently observed real-world exploitation; per The Hacker News' reporting on that telemetry, 36 exploitation attempts from 12 unique attacker IP addresses were detected over 12 days, with attackers dropping web shells named x.php and z.php and running id/echo discovery commands. Shadowserver data reported by BleepingComputer counts over 22,000 NetScaler ADC appliances and nearly 1,800 Gateway instances still reachable from the internet as of August 27-28, underscoring how much of the affected fleet has yet to remediate as the deadline arrives. No authentication or user interaction is required to exploit an unpatched, internet-facing appliance.","title":"Patch Citrix NetScaler ADC/Gateway for CVE-2026-8452 -- CISA KEV Deadline Today, 22,000+ Appliances Still Exposed","url":"https://www.helpnetsecurity.com/2026/08/27/netscaler-adc-gateway-cve-2026-8452/"}