--- title: You’re Back In The Room (Citrix NetScaler Pre-Auth RCE... description: Watchtowr Labs details a pre-authentication remote code execution vulnerability in Citrix NetScaler ADC and Gateway (believed to be CVE-2026-8452), affecting... canonical: https://daily.dev/posts/you-re-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452--wjcr93xtf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?)) | daily.dev og:description: Watchtowr Labs details a pre-authentication remote code execution vulnerability in Citrix NetScaler ADC and Gateway (believed to be CVE-2026-8452), affecting... og:url: https://daily.dev/posts/you-re-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452--wjcr93xtf og:image: https://api.daily.dev/og/posts/wjCR93xtf.png og:image:alt: You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?)) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?)) **[watchTowr Labs](https://daily.dev/sources/watchtowr-labs)** · 22 min read · 1 upvotes · 0 comments ## Summary Watchtowr Labs details a pre-authentication remote code execution vulnerability in Citrix NetScaler ADC and Gateway (believed to be CVE-2026-8452), affecting versions before 14.1-72.61 and 13.1-63.18. The bug is a heap overflow in the SAML signature canonicalization path: an oversized PrefixList attribute in the ds:SignedInfo element overflows a fixed-size buffer into adjacent nsb chunk headers, corrupting a data pointer used by a later memcpy. Because the binary is non-PIE with no ASLR and the heap is executable, the researchers turn this into a write-what-where primitive, overwrite the tx_pkt_complete_fptr function pointer to redirect execution to shellcode on the heap, drop a PHP webshell, neutralize signal handlers to prevent pitboss from rebooting the appliance, and set the SUID bit on /bin/sh to escalate from nobody to root. The vulnerability is reachable when NetScaler is configured as a SAML SP or IdP, requiring no authentication. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Which Citrix NetScaler versions are affected by the SAML pre-auth heap overflow RCE vulnerability? NetScaler ADC and NetScaler Gateway 14.1 before 14.1-72.61 and 13.1 before 13.1-63.18 are affected. The vulnerability is reachable when the appliance is configured to use SAML as either a Service Provider or Identity Provider. Patched versions add explicit size checks around the SignedInfo canonicalization buffer copy. _Security teams managing NetScaler deployments track patch coverage like this on daily.dev._ ### How does the Citrix NetScaler SAML heap overflow work technically and what makes it exploitable without authentication? During SAML signature canonicalization, NetScaler copies attacker-controlled data from the ds:SignedInfo PrefixList attribute into a fixed-size global buffer without bounds checking. Sending an oversized PrefixList overflows into the adjacent nsb chunk header, corrupting its data pointer field at offset +0x50. Because the binary is non-PIE with no ASLR and the heap is executable, this becomes a write-what-where primitive leading to RIP control via the tx_pkt_complete_fptr function pointer. _Exploit researchers following NetScaler and enterprise VPN vulnerabilities find the full chain on daily.dev._ ### How can you prevent Citrix NetScaler from rebooting the whole appliance when nsppe crashes during exploit development? NetScaler's pitboss process monitors nsppe via signal handlers registered for SIGSEGV, SIGBUS, SIGILL, SIGABRT, SIGFPE, and SIGTRAP. When those handlers fire, pitboss triggers a full reboot. Using the sigaction syscall (416 on FreeBSD) to set SIG_IGN on all those signals before crashing causes pitboss to respawn nsppe instead of rebooting, preserving any files written to disk by shellcode. _Defenders and red teamers tracking NetScaler exploitation techniques stay current on daily.dev._ ## Similar posts on daily.dev - [CitrixBleed To Infinity And Beyond \(Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451\)](https://daily.dev/posts/citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451--puoeut5ij) · watchTowr Labs · 0 upvotes · 0 comments - [NetScaler Memory Overread Flaw Revives CitrixBleed Fears](https://daily.dev/posts/netscaler-memory-overread-flaw-revives-citrixbleed-fears-2ovgfwszg) · Latest Hacking News · 0 upvotes · 0 comments - [Mind the Config: Detecting and Weaponizing NetScaler CVE-2026-19490](https://daily.dev/posts/mind-the-config-detecting-and-weaponizing-netscaler-cve-2026-19490-c1cyhu7f0) · Sliver C2 Documentation · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/you-re-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452--wjcr93xtf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))","url":"https://daily.dev/posts/you-re-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452--wjcr93xtf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/you-re-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452--wjcr93xtf"},"datePublished":"2026-08-14T07:12:56.994Z","dateModified":"2026-09-14T09:12:59.196Z","description":"Watchtowr Labs details a pre-authentication remote code execution vulnerability in Citrix NetScaler ADC and Gateway (believed to be CVE-2026-8452), affecting...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/28a84c1141ad17c3940da24176b93a7c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/28a84c1141ad17c3940da24176b93a7c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"watchTowr Labs","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"watchTowr Labs","logo":"https://media.daily.dev/image/upload/s--6_x7BAvI--/f_auto,q_auto/v1774959933/logos/watchtowr-labs?_a=BAMAMiWQ0","url":"https://daily.dev/sources/watchtowr-labs"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/you-re-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452--wjcr93xtf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT22M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"watchTowr Labs","item":"https://daily.dev/sources/watchtowr-labs"},{"@type":"ListItem","position":3,"name":"You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/you-re-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452--wjcr93xtf#faq","mainEntity":[{"@type":"Question","name":"Which Citrix NetScaler versions are affected by the SAML pre-auth heap overflow RCE vulnerability?","acceptedAnswer":{"@type":"Answer","text":"NetScaler ADC and NetScaler Gateway 14.1 before 14.1-72.61 and 13.1 before 13.1-63.18 are affected. The vulnerability is reachable when the appliance is configured to use SAML as either a Service Provider or Identity Provider. Patched versions add explicit size checks around the SignedInfo canonicalization buffer copy. Security teams managing NetScaler deployments track patch coverage like this on daily.dev."}},{"@type":"Question","name":"How does the Citrix NetScaler SAML heap overflow work technically and what makes it exploitable without authentication?","acceptedAnswer":{"@type":"Answer","text":"During SAML signature canonicalization, NetScaler copies attacker-controlled data from the ds:SignedInfo PrefixList attribute into a fixed-size global buffer without bounds checking. Sending an oversized PrefixList overflows into the adjacent nsb chunk header, corrupting its data pointer field at offset +0x50. Because the binary is non-PIE with no ASLR and the heap is executable, this becomes a write-what-where primitive leading to RIP control via the tx_pkt_complete_fptr function pointer. Exploit researchers following NetScaler and enterprise VPN vulnerabilities find the full chain on daily.dev."}},{"@type":"Question","name":"How can you prevent Citrix NetScaler from rebooting the whole appliance when nsppe crashes during exploit development?","acceptedAnswer":{"@type":"Answer","text":"NetScaler's pitboss process monitors nsppe via signal handlers registered for SIGSEGV, SIGBUS, SIGILL, SIGABRT, SIGFPE, and SIGTRAP. When those handlers fire, pitboss triggers a full reboot. Using the sigaction syscall (416 on FreeBSD) to set SIG_IGN on all those signals before crashing causes pitboss to respawn nsppe instead of rebooting, preserving any files written to disk by shellcode. Defenders and red teamers tracking NetScaler exploitation techniques stay current on daily.dev."}}]} ```