watchTowr Labs Turns Citrix CVE-2026-8452 Into Root RCE on NetScaler 13.1
Updated
Updated · watchTowr Labs · Aug 17
watchTowr Labs Turns Citrix CVE-2026-8452 Into Root RCE on NetScaler 13.1
1 articles · Updated · watchTowr Labs · Aug 17
Summary
watchTowr Labs said it achieved unauthenticated remote code execution and root access on vulnerable Citrix NetScaler ADC and Gateway appliances by exploiting a heap overflow tied to SAML handling.
The bug affects NetScaler 14.1 before 14.1-72.61 and 13.1 before 13.1-63.18, where an oversized SAML SignedInfo PrefixList overflows a fixed buffer during canonicalization and corrupts adjacent heap metadata.
That corruption let the researchers turn a later memcpy into a write-what-where primitive, overwrite a function pointer, and gain full RIP control; they said the non-PIE binary, lack of ASLR and an executable heap simplified exploitation.
Their shellcode dropped a webshell, disabled crash signal handlers so pitboss respawned nsppe instead of rebooting the appliance, and then used nsppe's root context to make /bin/sh SUID for persistent root command execution.
The writeup underscores that SAML-enabled NetScaler gateways—widely used as enterprise remote-access front doors—can be exposed to unauthenticated takeover if not patched.
Why are decades-old XML parsing flaws still handing attackers the keys to modern enterprise networks in 2026?
Could your enterprise gateway be silently respawning a hidden root shell without triggering a single reboot alert?
CVE-2026-8452: Anatomy of a Critical NetScaler SAML Heap Overflow and the Race to Patch Amid Active Exploitation
Overview
In August 2026, the threat landscape for Citrix NetScaler appliances changed dramatically after researchers published a working exploit for CVE-2026-8452. Attackers quickly began targeting unpatched devices, sending oversized SAML SignedInfo payloads that overflowed a buffer in the authentication handler. This corrupted the NetScaler Packet Processing Engine’s memory, allowing attackers to control where and what they wrote in memory. By overwriting function pointers, they could execute malicious code with full root privileges. Because the core process runs as root, this gave attackers complete control over the appliance, making immediate patching essential to prevent compromise.