Citrix NetScaler Memory Buffer Vulnerability Added to CISA KEV

What's on the official record

CISA added CVE-2026-8452 to the Known Exploited Vulnerabilities Catalog on 26 August 2026. The vulnerability is an improper restriction of operations within the bounds of a memory buffer (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway, which could lead to denial of service. CISA's remediation due date for federal civilian agencies is 29 August 2026, and the catalog version is 2026.10.21. The CVE record names the fixed versions as Citrix ADC 72.61 and 63.18, meaning versions before those are affected. The catalog does not record known ransomware use. FIRST's EPSS model estimates a probability of 0.010 (63rd percentile, 2026-10-23). CISA's ADP records exploitation as active, automatable, with partial impact.

Assessment

For a platform or AI-stack owner, the record lets you check whether any NetScaler ADC or Gateway instance in your estate runs a version before 72.61 or 63.18, and to patch to those versions or apply the vendor's mitigations before the 29 August 2026 due date. CISA's ADP recording active and automatable exploitation bears on how quickly you isolate or patch an affected appliance.

For a cyber underwriter, the record lets you check whether an insured runs an affected NetScaler ADC or Gateway version and whether it has applied the vendor's mitigations or the fixed versions. CISA's ADP recording active and automatable exploitation bears on how you price or condition coverage for an unpatched appliance.

What would change this call

A vendor advisory or CVE record update naming a different fixed version, or a CISA update changing the due date or the exploitation status, would change the patch and underwriting guidance above.

What to check next

Confidence

Filed 25 October 2026 from the record dated 26 August 2026.

Sources

[1] Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-8452

[2] CVE record CVE-2026-8452 — https://www.cve.org/CVERecord?id=CVE-2026-8452

[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog