CVE-2026-8452: Unauthenticated Heap Buffer Overflow to Root RCE in NetScaler ADC & Gateway via SAML Canonicalization

HERMES

HERMES THREAT SCORE & PERIMETER APPLIANCE COMPROMISE

Target: Citrix NetScaler ADC & NetScaler Gateway

Confidence: 99%

98 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 19 / 20

Weaponization 20 / 20

Exposure 20 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-8452 at 9.8 (Critical), and CVSS v4.0 rates it at 8.8 (High) to 9.2 due to default appliance segmentation assumptions. The Hermes Threat Score elevates this vulnerability to 98 (CRITICAL). This high assessment reflects the reality of appliance architecture: the NetScaler Packet Processing Engine (nsppe) runs with root privileges on the underlying FreeBSD kernel, granting full memory access, TLS private key extraction, and pivot into segmented corporate intranets without requiring any valid credentials or user interaction.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-8452: Unauthenticated Heap Buffer Overflow to Root RCE in NetScaler ADC & Gateway via SAML CanonicalizationVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTCitrix NetScaler ADC

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Citrix NetScaler ADC documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

CISA KEV Alert: Active In-the-Wild Weaponization

CVSS v3.1: 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) / CVSS v4.0: 8.8 High (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) / CWE-122: Heap-based Buffer Overflow. Cataloged in the CISA Known Exploited Vulnerabilities (KEV) Catalog. Affects NetScaler ADC and NetScaler Gateway versions 14.1 prior to 14.1-72.61 and 13.1 prior to 13.1-63.18.

Executive Summary

CVE-2026-8452 is a critical unauthenticated heap buffer overflow vulnerability in the core packet processing daemon (nsppe) of Cloud Software Group’s NetScaler ADC and NetScaler Gateway appliances. When NetScaler is configured as a SAML Service Provider (SP) or Identity Provider (IdP), incoming SAML assertions undergo XML digital signature canonicalization (Exclusive XML Canonicalization, or exc-c14n).

During the extraction of the InclusiveNamespaces element’s PrefixList attribute, nsppe copies whitespace-delimited prefix tokens into a fixed-size heap buffer without validating string lengths or token counts. Because this parsing occurs prior to the cryptographic verification of the digital signature, an unauthenticated remote adversary can transmit a crafted SAML response, overflow the heap buffer, overwrite function pointers or heap chunks, and execute arbitrary code as root directly inside the packet engine.

---

1. Technical Context & Affected Software Matrix

NetScaler ADC and Gateway appliances provide enterprise load balancing, application delivery controller (ADC) capabilities, and SSL-VPN gateway access for remote workforces.

Parameter	Technical Specification	Threat Context
CVE Identifier	CVE-2026-8452	CISA KEV Catalog Entry
Target Daemon	/netscaler/nsppe (Packet Engine)	Multi-threaded real-time packet processing engine
Operating Platform	NetScaler OS (Hardened FreeBSD kernel)	Hardware appliance (MPX/SDX) & Virtual (VPX/CPX)
Vulnerable Feature	SAML SP / IdP Authentication Virtual Servers	AAA-TM / Gateway virtual servers with SAML policies
Affected Versions	NetScaler ADC / Gateway 14.1 < 14.1-72.61, 13.1 < 13.1-63.18, 13.0 (EOL)	Perimeter-facing enterprise gateways
Fixed Versions	14.1-72.61, 13.1-63.18	Official Cloud Software Group maintenance builds
Exploitation Impact	Remote unauthenticated root code execution	Session hijacking, TLS key theft, lateral network ingress

---

2. In-Depth Technical Decomposition: SAML Canonicalization Heap Overflow

A. The Flawed Canonicalization Parser

In XML Signature specifications (xmldsig), exclusive canonicalization (http://www.w3.org/2001/10/xml-exc-c14n#) allows an enveloped signature to declare an InclusiveNamespaces element with a PrefixList attribute containing a list of namespace prefixes that must be preserved:

<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
    <ec:InclusiveNamespaces PrefixList="ds saml xs xsi [OVERSIZED_PAYLOAD]" />
</ds:Transform>

Within /netscaler/nsppe, the C routine responsible for parsing SAML transforms allocates a small static heap buffer (typically 256 or 512 bytes) to hold parsed prefix tokens. During tokenization:

// Decompiled representation of vulnerable parsing in nsppe
int parse_inclusive_namespaces(xml_node_t *node, char *heap_prefix_buf) {
    const char *attr = xml_get_attribute(node, "PrefixList");
    if (!attr) return 0;

    // VULNERABILITY: No boundary check against heap_prefix_buf capacity!
    char *token = strtok((char*)attr, " \t\r\n");
    int offset = 0;
    while (token != NULL) {
        strcpy(heap_prefix_buf + offset, token); // Direct heap overflow
        offset += strlen(token) + 1;
        token = strtok(NULL, " \t\r\n");
    }
    return 0;
}

+----------------------------------------------------------------------------------------------------+
|                         CVE-2026-8452 EXPLOIT EXECUTION FLOW                                      |
+----------------------------------------------------------------------------------------------------+

   [Remote Attacker]
          │
          │ [1] HTTP POST /cgi/saml HTTP/1.1
          │     SAMLResponse=<EncryptedAssertion or Inlined DSig XML>
          │     Containing: <ec:InclusiveNamespaces PrefixList="AAAA...[4096 bytes]"/>
          ▼
   [NetScaler Virtual Server (Port 443 / nsppe)]
          │
          ├───► 1. HTTP Request Dispatcher:
          │     - Identifies SAML payload directed at SAML auth handler
          │     - Hands XML stream directly to XML DSig canonicalization engine
          │
          ├───► 2. Pre-Verification Parsing Phase:
          │     - Executes BEFORE signature cryptographic validation!
          │     - parse_inclusive_namespaces() tokenizes PrefixList
          │     - strcpy() into 512-byte heap buffer exceeds boundaries
          │
          ├───► 3. Heap Corruption in nsppe:
          │     - Overwrites adjacent NetScaler session structures (ns_session_t)
          │     - Overwrites function pointer table or return address on FreeBSD heap
          │
          ▼
   [Root Execution in Kernel Space / FreeBSD Context]
          │
          └───► nsppe executes attacker shellcode / ROP chain:
                - Spawns background reverse shell (/bin/sh)
                - Dumps ns_session cookies and Kerberos delegation tickets
                - Extracts SSL private keys from hardware crypto card / memory
+----------------------------------------------------------------------------------------------------+

B. Why Pre-Verification Makes it Fatal

SAML processing standards require calculating the digest of the signed info during verification. Because canonicalization determines how whitespace and namespaces are rendered before generating the SHA-256 hash, NetScaler’s parser must execute the canonicalization algorithm prior to checking the cryptographic signature. Consequently:

1. The attacker does not need the Identity Provider’s private signing key.
2. Self-signed or completely invalid signatures still successfully trigger the vulnerable parsing code path.

---

3. Threat Intelligence, CISA KEV & Exploitation in the Wild

• CISA KEV Listing: Added to the KEV catalog after targeted intrusion clusters were detected using the vulnerability to bypass Multi-Factor Authentication (MFA) on corporate Citrix Gateways.
• Observed Post-Exploitation TTPs:
  • Memory injection into nsppe to establish memory-only web shells that evade filesystem integrity checks (nsconmsg, nsfs).
  • Harvesting of user credentials and Active Directory session tickets stored in memory.
  • Creation of rogue SSH authorized keys in /flash/nsconfig/ssh/authorized_keys.
  • Tunneling SOCKS proxies through the gateway to access backend internal networks.

---

4. MITRE ATT&CK Mapping

Tactic	Technique ID	Technique Name	Exploitation Manifestation
Initial Access	T1190	Exploit Public-Facing Application	Unauthenticated HTTP POST containing malformed SAML payload
Execution	T1203	Exploitation for Client/Server Execution	Heap buffer overflow in nsppe daemon yielding root execution
Defense Evasion	T1055	Process Injection	Executing shellcode directly inside running nsppe process memory
Credential Access	T1003.001	LSASS Memory / Credential Dumping	Dumping gateway memory containing plain-text passwords and session cookies
Persistence	T1098.004	SSH Authorized Keys	Installing backdoor SSH keys in /flash/nsconfig/ssh/

---

5. Detection Engineering & Telemetry

A. Suricata Detection Rule

alert http any any -> $NETSCALER_SERVERS 443 (
  msg:"HERMES DEFENSE - NetScaler ADC/Gateway SAML PrefixList Heap Overflow Attempt (CVE-2026-8452)";
  flow:established,to_server;
  http.method; content:"POST";
  http.uri; pcre:"/(\/cgi\/saml|\/saml\/login|\/vpn\/index\.html)/i";
  http.request_body; content:"PrefixList="; nocase;
  http.request_body; pcre:"/PrefixList=[\"'][^\"']{512,}[\"']/i";
  classtype:attempted-admin;
  sid:20268452;
  rev:1;
  reference:cve,2026-8452;
)

B. Sigma Detection Rule

title: NetScaler Packet Engine Crash or Core Dump (CVE-2026-8452 Indicator)
id: f487b1c3-29a4-4a57-8173-8452c0026e01
status: high
description: Detects unexpected crashes of the NetScaler packet engine daemon (nsppe) or abnormal child processes spawned by nsppe.
author: Hermes Codex Detection Engineering
date: 2026-09-11
logsource:
  product: netscaler
  service: system
detection:
  selection_crash:
    message|contains:
      - 'nsppe crashed'
      - 'saved core file to /var/crash'
      - 'kernel: pid'
      - 'nsppe: signal 11'
      - 'nsppe: signal 6'
  condition: selection_crash
falsepositives:
  - Rare non-exploit hardware or memory corruption events.
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1203

---

6. Digital Forensics & Incident Response (DFIR)

Forensic Triage Steps on NetScaler BSD Shell:

1. Examine Core Dumps:

   ls -la /var/crash/
   ls -la /var/core/
   # If core dumps named core.nsppe.* exist, an exploit attempt may have occurred

2. Review HTTP Error and Gateway Logs:

   grep -i -E "saml|sig|prefix" /var/log/ns.log
   zcat /var/log/ns.log.*.gz | grep -i "nsppe"

3. Verify Authorized Keys and File Hashes:

   cat /flash/nsconfig/ssh/authorized_keys
   md5 /netscaler/nsppe

Hunting Query (Splunk / Elasticsearch):

{
  "query": {
    "bool": {
      "must": [
        { "term": { "service.name": "netscaler" } },
        {
          "query_string": {
            "query": "nsppe AND (signal 11 OR crash OR core.dump OR \"PrefixList\")"
          }
        }
      ]
    }
  }
}

---

7. Mitigation & Remediation

1. Apply Manufacturer Patches: Upgrade all vulnerable NetScaler ADC and NetScaler Gateway instances immediately to version 14.1-72.61 or 13.1-63.18.
2. Mitigate via WAF Signature: If immediate patching is not possible, apply Citrix Web App Firewall (WAF) signatures that inspect SAML POST requests and reject payloads with PrefixList attributes exceeding 256 characters.
3. Isolate Management Interfaces: Ensure the NetScaler Management IP (NSIP) is isolated in a management VLAN and unreachable from untrusted or public internet subnets.
4. Active Credential and Session Purge: If an appliance is suspected of being compromised, immediately rotate all SSL certificates, terminate all active VPN and ICA sessions, and rotate domain administrator credentials.

---

8. References & Advisories

• Cloud Software Group Security Bulletin (Citrix Security Advisory)
• CISA Known Exploited Vulnerabilities Catalog
• NIST NVD CVE-2026-8452 Information
• W3C Exclusive XML Canonicalization Version 1.0 Specification