CISA Adds CVE-2026-8452 to KEV Catalog and Orders Federal Agencies to Patch Citrix NetScaler by August 29 2026
CISA has added CVE-2026-8452 to its Known Exploited Vulnerabilities catalog, forcing US federal agencies to patch Citrix NetScaler before the strict deadline of August 29 2026.
The vulnerability affects NetScaler ADC and NetScaler Gateway when the appliance operates as a VPN Gateway or AAA virtual server. These perimeter devices provide remote access to corporate networks, making them high-value targets for attackers seeking initial entry points.
Originally described by Citrix as a memory overflow capable of causing erratic behavior and denial of service, the issue was later shown through public technical analysis to support unauthenticated remote code execution with root privileges on unpatched systems.
The attack surface expands significantly in environments using SAML, whether the device functions as a Service Provider or Identity Provider, particularly in single sign-on deployments.
Observed campaigns follow a spray-and-pray pattern, with attackers deploying webshells after successful compromise and executing basic reconnaissance commands to map the environment.
With tens of thousands of NetScaler devices exposed to the internet, many configured as public Gateway instances, the flaw is expected to trigger widespread automated scanning and exploitation attempts.
Citrix has released corrected builds that close the vulnerability, including version 14.1-72.61, 13.1-63.18, and 13.1-37.272 or higher for FIPS and NDcPP configurations.
Defensive recommendations include immediate inventory of exposed instances, verification of actual software versions and configurations, active hunting for webshells and reconnaissance indicators, and implementation of network segmentation and administrative access restrictions where patching cannot be completed instantly.
Related articles
Researcher Achieves SSTI-Based Defacement of First Partner Bank Web Service on Standoff 365
A security researcher known as grizzzer detailed a full attack chain that resulted in defacing the authorization page of the First Partner Bank digital banking service inside the Standoff 365 online polygon. The demonstration began with a successful DNS zone transfer against the fpb.stf domain, revealing the dbo.fpb.stf host that hosted the target application. After identifying the Node.js, Express, and React stack, the researcher discovered that the receipt generation endpoint accepted an undocumented pretty parameter that was passed directly into the Pug template engine. This led to a server-side template injection vulnerability that was escalated to a Node.js reverse shell. With code execution, the attacker located and modified the translation.json localization file, replacing the welcome message with the string pwned by VON visible to all users. The write-up concludes with concrete hardening recommendations including disabling zone transfers, avoiding direct spread of req.query into templates, and restricting outbound connections.
Telegram Desktop Bug Deletes 800 GB of User Data Due to Spelling Checker Path Error
A Telegram Desktop update introduced a critical flaw that caused the application to recursively delete user folders containing up to 800 GB of data on Windows systems. The root cause traced back to an incorrect path construction for the custom dictionary file used by the lib_spellcheck library when Windows native spell checking was enabled. Due to a misplaced return statement in the code, the working directory path remained empty, leading Qt to interpret the path as the root-level C:\custom folder. The application then invoked QDir::removeRecursively on this directory, removing all accessible files while skipping locked ones. The bug affected releases 7.1.0 and 7.1.1 for approximately 66 hours before being fixed in version 7.1.2. Researchers used Process Monitor to confirm Telegram.exe was directly responsible for the deletion attempts. The incident highlights risks of combining recursive deletion functions with unvalidated path inputs in widely used applications.
WatchGuard Issues Emergency Patches for Fireware OS Addressing 11 Vulnerabilities Including Pre-Auth RCE
WatchGuard Technologies released security updates for its Firebox firewall products on August 27, 2026, addressing 11 vulnerabilities in Fireware OS. Nine of the flaws affect the IKE daemon (iked) and can lead to buffer overflows, out-of-bounds reads, and double-free conditions when processing crafted IKE messages. Three CVEs (CVE-2026-19313, CVE-2026-19315, and CVE-2026-19318) may allow unauthenticated remote code execution due to memory corruption, with CVE-2026-19318 requiring the IKE payload diagnostic log to be enabled. An additional flaw, CVE-2026-13086, resides in the deprecated Mobile Security epm service and permits adjacent-network attackers with access to a trusted interface to execute arbitrary code as root without authentication. The company urges immediate application of Fireware versions 2026.2.2, 12.12.2, and 12.5.20.
CISA Orders Federal Agencies to Patch Critical Citrix NetScaler RCE Flaw by August 29 2026
CISA has added CVE-2026-8452 to its Known Exploited Vulnerabilities catalog and set an unusually tight deadline for U.S. federal agencies to remediate the issue in Citrix NetScaler products. The vulnerability, initially described as a denial-of-service condition, is now actively exploited to achieve unauthenticated remote code execution with root privileges on unpatched appliances. Affected configurations include NetScaler ADC and NetScaler Gateway when deployed as VPN Gateway or AAA virtual servers, especially in environments using SAML for single sign-on. Attackers have been observed deploying webshells and performing reconnaissance after initial compromise in a spray-and-pray pattern. Tens of thousands of NetScaler devices remain exposed to the internet, increasing the risk of widespread automated attacks. Citrix has released fixed builds including 14.1-72.61 and 13.1-63.18, along with specific versions for FIPS and NDcPP environments.