--- title: No Crash Required: Verifying the Citrix NetScaler SAML… description: CVE-2026-8452 is an unauthenticated heap overflow in the SAML parsing code of Citrix NetScaler ADC and Gateway, rated CVSS 8.8, triggered by an oversized... canonical: https://daily.dev/posts/no-crash-required-verifying-the-citrix-netscaler-saml--tnf1dpkbm twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: No Crash Required: Verifying the Citrix NetScaler SAML… | daily.dev og:description: CVE-2026-8452 is an unauthenticated heap overflow in the SAML parsing code of Citrix NetScaler ADC and Gateway, rated CVSS 8.8, triggered by an oversized... og:url: https://daily.dev/posts/no-crash-required-verifying-the-citrix-netscaler-saml--tnf1dpkbm og:image: https://api.daily.dev/og/posts/tnf1DpkBm.png og:image:alt: No Crash Required: Verifying the Citrix NetScaler SAML… og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # No Crash Required: Verifying the Citrix NetScaler SAML… **[Sliver C2 Documentation](https://daily.dev/sources/bishopfox)** · 17 min read · 0 upvotes · 0 comments ## Summary CVE-2026-8452 is an unauthenticated heap overflow in the SAML parsing code of Citrix NetScaler ADC and Gateway, rated CVSS 8.8, triggered by an oversized PrefixList value during XML canonicalization before signature verification. Bishop Fox reproduced watchTowr Labs' proof of concept, confirmed the bug is not version-specific despite exploit chains being build-specific, and built a safe external detection probe that distinguishes patched from unpatched appliances using a 513-byte length oracle without crashing the device. The fix, first shipped in 13.1-63.18 and 14.1-72.61, caps PrefixList at 512 bytes and adds broader buffer-size guards. The piece also covers exploitation forensics, warning that a quiet packet-engine restart versus a full reboot is not a reliable signal of successful compromise, and provides guidance on scoping affected virtual servers, sibling CVEs 2026-8451 and 2026-19490, and file-system indicators of compromise. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-8452 in Citrix NetScaler and how severe is it? CVE-2026-8452 is an unauthenticated heap overflow, rated CVSS 8.8, in the SAML message parsing code on Citrix NetScaler ADC and Gateway. It occurs because the PrefixList field from an XML signature's canonicalization method is copied into a fixed-size buffer without a length check, and the code runs before the SAML signature is verified, so a single unauthenticated HTTP request can corrupt memory and potentially achieve remote code execution. _Track NetScaler CVE details like this on daily.dev while prioritizing patches across a virtual server fleet._ ### Which Citrix NetScaler builds fix CVE-2026-8452 and what changed? The fix first shipped in NetScaler builds 13.1-63.18 and 14.1-72.61, which cap the PrefixList value at 512 bytes and return 'Malformed Assertion sent to Netscaler' instead of rewriting oversized input. The patch also adds a 4,096-byte working buffer with bounds checks in signature verification, a 510-byte limit on copying an opening XML tag, and guards against negative or oversized length values. NetScaler 12.1 and 13.0 receive no fix and must be migrated off. _Developers upgrading NetScaler builds can follow security fix details like these on daily.dev._ ### How can I tell if my Citrix NetScaler is patched against CVE-2026-8452 without crashing it? Send a signed SAML AuthnRequest or SAMLResponse with a 575-byte PrefixList to /saml/login or /cgi/samlauth; a patched appliance rejects it at its 512-byte size check while an unpatched one proceeds further, since 575 bytes sits safely below the roughly 1,151-byte threshold where memory corruption begins. Confirm with a control request using a 35-byte PrefixList; if both requests return the same answer, the result is inconclusive rather than confirmed patched. _Security teams verifying patch status across appliance fleets can follow probes like this on daily.dev._ ## Similar posts on daily.dev - [You’re Back In The Room \(Citrix NetScaler Pre-Auth RCE CVE-2026-8452\(?\)\)](https://daily.dev/posts/you-re-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452--wjcr93xtf) · watchTowr Labs · 1 upvotes · 0 comments - [NetScaler Memory Overread Flaw Revives CitrixBleed Fears](https://daily.dev/posts/netscaler-memory-overread-flaw-revives-citrixbleed-fears-2ovgfwszg) · Latest Hacking News · 0 upvotes · 0 comments - [Mind the Config: Detecting and Weaponizing NetScaler CVE-2026-19490](https://daily.dev/posts/mind-the-config-detecting-and-weaponizing-netscaler-cve-2026-19490-c1cyhu7f0) · Sliver C2 Documentation · 0 upvotes · 0 comments - [Critical Citrix NetScaler Flaw Draws CitrixBleed Comparisons as Exploitation Window Narrows](https://daily.dev/posts/critical-citrix-netscaler-flaw-draws-citrixbleed-comparisons-as-exploitation-window-narrows-iikwjwkhl) · IT Security Guru · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/no-crash-required-verifying-the-citrix-netscaler-saml--tnf1dpkbm) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"No Crash Required: Verifying the Citrix NetScaler SAML…","url":"https://daily.dev/posts/no-crash-required-verifying-the-citrix-netscaler-saml--tnf1dpkbm","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/no-crash-required-verifying-the-citrix-netscaler-saml--tnf1dpkbm"},"datePublished":"2026-08-23T12:19:04.361Z","dateModified":"2026-08-27T09:23:10.977Z","description":"CVE-2026-8452 is an unauthenticated heap overflow in the SAML parsing code of Citrix NetScaler ADC and Gateway, rated CVSS 8.8, triggered by an oversized...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dd048316927b934a9c4ded63f8cba1cf?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dd048316927b934a9c4ded63f8cba1cf?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Sliver C2 Documentation","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sliver C2 Documentation","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/bishopfox"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/no-crash-required-verifying-the-citrix-netscaler-saml--tnf1dpkbm","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT17M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sliver C2 Documentation","item":"https://daily.dev/sources/bishopfox"},{"@type":"ListItem","position":3,"name":"No Crash Required: Verifying the Citrix NetScaler SAML…"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/no-crash-required-verifying-the-citrix-netscaler-saml--tnf1dpkbm#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-8452 in Citrix NetScaler and how severe is it?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-8452 is an unauthenticated heap overflow, rated CVSS 8.8, in the SAML message parsing code on Citrix NetScaler ADC and Gateway. It occurs because the PrefixList field from an XML signature's canonicalization method is copied into a fixed-size buffer without a length check, and the code runs before the SAML signature is verified, so a single unauthenticated HTTP request can corrupt memory and potentially achieve remote code execution. Track NetScaler CVE details like this on daily.dev while prioritizing patches across a virtual server fleet."}},{"@type":"Question","name":"Which Citrix NetScaler builds fix CVE-2026-8452 and what changed?","acceptedAnswer":{"@type":"Answer","text":"The fix first shipped in NetScaler builds 13.1-63.18 and 14.1-72.61, which cap the PrefixList value at 512 bytes and return 'Malformed Assertion sent to Netscaler' instead of rewriting oversized input. The patch also adds a 4,096-byte working buffer with bounds checks in signature verification, a 510-byte limit on copying an opening XML tag, and guards against negative or oversized length values. NetScaler 12.1 and 13.0 receive no fix and must be migrated off. Developers upgrading NetScaler builds can follow security fix details like these on daily.dev."}},{"@type":"Question","name":"How can I tell if my Citrix NetScaler is patched against CVE-2026-8452 without crashing it?","acceptedAnswer":{"@type":"Answer","text":"Send a signed SAML AuthnRequest or SAMLResponse with a 575-byte PrefixList to /saml/login or /cgi/samlauth; a patched appliance rejects it at its 512-byte size check while an unpatched one proceeds further, since 575 bytes sits safely below the roughly 1,151-byte threshold where memory corruption begins. Confirm with a control request using a 35-byte PrefixList; if both requests return the same answer, the result is inconclusive rather than confirmed patched. Security teams verifying patch status across appliance fleets can follow probes like this on daily.dev."}}]} ```