{"uuid": "6800c5e3-ae83-47bc-9c7a-8d1e9938371c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8452", "type": "published-proof-of-concept", "source": "https://t.me/P0x3k_1N73LL1G3NC3/417", "content": "\ud83d\udd12 Citrix NetScaler Pre-Auth RCE (CVE-2026-8452)\n\nUnauthenticated heap overflow in SAML signature canonicalization. An oversized PrefixList inside the  InclusiveNamespaces element overflows a fixed-size buffer, corrupting adjacent nsb chunk metadata. This yields a write-what-where primitive (controlled memcpy src/dst), allowing overwrite of tx_pkt_complete_fptr and jump to attacker shellcode on the executable heap. Results in root RCE when NetScaler is configured as SAML SP or IdP.\n\nAffected: NetScaler ADC/Gateway 14.1 < 14.1-72.61 and 13.1 < 13.1-63.18\n\n\ud83d\udd17 Research:\nhttps://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452/\n\n\ud83d\udd17 Source:\nhttps://github.com/watchtowrlabs/watchTowr-vs-Citrix-Netscaler-PreAuth-RCE-CVE-2026-8452\n\n#citrix #netscaler #rce #preauth #saml #heapoverflow", "creation_timestamp": "2026-08-23T00:00:13.195193Z"}