Unauthenticated attackers exploit XML parser flaw to leak memory from NetScaler appliances
Attackers are actively probing NetScaler appliances to trigger memory disclosure via a new XML parser flaw. This vulnerability affects instances configured as SAML Identity Providers (IDP) and can be exploited without authentication. Patch your NetScaler ADC or Gateways immediately to mitigate the risk. 馃毃
Summary
Threat actors began targeting NetScaler ADC and Net靷ゼ Gateways less than a day after the public disclosure of a critical memory disclosure vulnerability. The flaw, tracked as CVE-2026-8451, allows unauthenticated attackers to read sensitive memory contents from affected appliances.
Security researchers at watchTowr released technical details and a detection generator on June 30, coinciding with Citrix's release of security patches. Shortly after this disclosure, scanning activity was detected originating from infrastructure in Frankfurt, Germany, as well as a second actor using a Koapu Cloud HK IP address. Both actors demonstrated a pattern of probing specific endpoints and delivering payloads immediately upon receiving a successful response from the target.
Technical details
The vulnerability exists within the NetScaler XML parser. The parser fails to properly terminate unquoted XML attribute values when they are followed by a newline character. This oversight creates an out-of-bounds read condition.
When an attacker exploits this flaw, the parser reads past the intended buffer. The resulting memory contents are then returned to the attacker within the NSC_TASS cookie inside an HTTP response. While exploitation requires the NetScaler appliance to be configured as a SAML Identity Provider (IDP), no authentication is required to trigger the leak.
Proof of Concept
The observed attack payload involves sending a specific XML request structure to trigger the overread. According to researchers, the payload consists of a bare <samlp:AuthnRequest> tag padded with 476 spaces followed by a newline character.
A detection artefact generator for this behavior was published by watchTowr. Detailed technical information can be found at https://www.securityweek.com/new-citrixbleed-vulnerability-exploited-immediately-after-public-disclosure/
Defender guidance
Immediate action is required to prevent memory disclosure on exposed NetScaler instances.
- Apply Patches: Update NetScaler ADC and NetScaler Gateways to the latest versions provided by Citrix.
- Temporary Mitigation: If patching cannot be performed immediately, disable the SAML IDP configuration on the appliance.
- Log Inspection: Monitor logs for traffic directed at
/saml/login. Examine these request values for unusual padding or unexpected characters. - Cookie Analysis: Inspect
NSC_TASScookie values in HTTP responses to identify potential memory leakage or exploitation attempts.
Sources
