Citrix NetScaler: Critical SAML Memory Overflow Vulnerability CVE-2026-8452
CVE-2026-8452 is a critical memory overflow vulnerability residing in the SAML implementation of Citrix NetScaler ADC and Gateway. The flaw is triggered during the processing of SAML requests and assertions, where improper input buffer handling leads to memory corruption. This can result in a Denial of Service (DoS) or unpredictable system behavior. Due to the edge-facing nature of these appliances, the risk of unauthorized remote access or service disruption is significant. CISA has officially added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog following confirmed in-the-wild exploitation, mandating federal remediation by August 29, 2026. This flaw is part of a broader pattern of memory safety issues categorized by researchers as "CitrixBleed Infinity."
Anubis Ransomware Exploitation of Citrix NetScaler CVE-2025-5777
The Anubis Ransomware group is executing high-velocity exploitation of CVE-2025-5777, a critical vulnerability in Citrix NetScaler ADC/Gateway appliances, colloquially known as "Citrix Bleed 2." This vulnerability permits session token and memory disclosure, allowing attackers to bypass authentication and hijack active sessions. By targeting edge-facing infrastructure, Anubis circumvents traditional perimeter defenses to gain initial access, facilitating lateral movement and the subsequent deployment of ransomware payloads. This campaign marks a strategic shift toward leveraging N-day vulnerabilities in critical network appliances to conduct large-scale extortion and enterprise-wide encryption.