You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))
Suddenly, you’re in a room. You look around - oh, you’re surrounded by other new starters at your new job. Yes, it’s Monday, and you’re being onboarded.<br>You know the drill - it’s the typical enterprise “please don’t be a bad person or we may have to fire you” speech. But, you know what’s coming soon. It’s your favorite part of the onboarding process when you’ve started a new role.<br>It begins! The password policy requirements. You straighten your tie, because sure as heck, your SSLVPN credentials will not be the starting point for this organization. Not this time. Not again. You swore to yourself that you’d use a symbol this time.<br>Wait, did they just say NetScalers?<br>The world freezes around you. How are you back in the hellscape? You panic - what does a symbol matter in comparison to the traumatic nightmares you relive every day?<br>You realize the truth - nobody cares whether your password has a symbol or not. It’s already over for you.<br>Welcome back to another watchTowr Labs blog post.<br>It’s been three years since the last publicly documented NetScaler RCE writeup.<br>ChatGPT tells us that today we’re changing that. Exciting.<br>In this post, we’re going to walk through a vulnerability that was resolved as part of a recent NetScaler ADC and NetScaler Gateway Security Bulletin. As part of this bulletin, Citrix subtly? silently? loudly? patched a Heap Overflow vulnerability that we’re going to walk through today and show how it can be used to achieve Remote Code Execution.
0:00
/0:31
1×
Who Is Citrix NetScaler, and Why Is A Gateway Their First C Project?<br>Citrix NetScaler (formally rebranded, then un-rebranded, in the way that only enterprise networking vendors can truly pull off) is a family of application delivery controllers and VPN gateway appliances found in virtually every large enterprise network on the planet. NetScaler handles load balancing, SSL offloading, authentication, and remote access - and NetScaler Gateway specifically serves as the front door for thousands of organizations' remote access infrastructure.<br>Setting The Scene<br>To fuel today's analysis, we're analyzing and leveraging a vulnerable NetScaler 13.1 appliance, configured to leverage SAML.<br>Note: We've intentionally removed the exact build number used during exploit development. You don't need it. Sorry (not sorry).<br>For those wondering what is actually vulnerable, based on our testing, the vulnerability we’re discussing today is reachable when the Netscaler appliance is configured to use SAML as either a Service Provider (SP) or an Identity Provider (IdP).<br>Citrix lists the following versions as affected:<br>NetScaler ADC and NetScaler Gateway 14.1 BEFORE 14.1-72.61<br>NetScaler ADC and NetScaler Gateway 13.1 BEFORE 13.1-63.18<br>What Are We Looking At Today?<br>This is where things get a little confusing, annoying, or mysterious - your choice of word reflects your commitment to the pledge .<br>While we’d love to tell you we are definitely analyzing CVE-2026-8452, typical Citrix shenanigans (in our view) prevent us from doing so. However, we believe this is CVE-2026-8452 given its description as a “Memory Overflow” vulnerability.<br>While Citrix doesn't correlate individual CVEs with the researchers credited in the advisory, one of the researchers credited is Michael Tucker from the XOR team at JPMorgan Chase (the others include ourselves, and we can rule out our vulnerabilities).<br>Adding fuel to our baseless theory, this vulnerability is interesting and complex enough that it’s plausible that this is the output of Mythos-aided research - the model JPMorgan very publicly has access to.<br>Do we have any evidence of that?<br>Absolutely not.<br>Is it fun to speculate?<br>Always.<br>Do we have better things to do?<br>Anyway, Let’s Get Into it<br>As part of our typical analysis process, especially when dealing with multiple patched vulnerabilities bundled into a single fix, we didn’t start with a specific focus. Instead, we asked, “What changed?”<br>Specifically the nsppe binary, NetScaler's packet-processing engine, showed a significant amount of changes - with plenty of stripped symbols thrown in for good measure.<br>Faced with the prospect of asking Diaphora to diff 39,637 functions, we just screamed - nobody was happy.<br>After magic, laborious pain, and a slight distrust towards Secure by Designers, we were left with 174 changed functions to review.<br>Amongst these changes, we spotted a bunch of changes in the SAML authentication functionality. One change in particular, however, turned out to be particularly interesting: an unauthenticated, remotely reachable memory corruption.<br>A specific change caught our attention - the 63.18 patch adds explicit size checks around these copies, which, conveniently for us, is exactly what led us to the vulnerability in the first place.<br>During signature canonicalization, earlier versions of the NetScaler solution copy attacker-controlled data from the SAML message's ds:SignedInfo element...