CISA has added CVE‑2026‑8452 to its Known Exploited Vulnerabilities catalogue. The entry concerns Citrix NetScaler ADC and NetScaler Gateway, which contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could lead to a denial of service condition.
The flaw is a memory‑buffer bounds violation that can be triggered remotely, allowing an attacker to disrupt service availability. It has been assigned a CVSS base score of 8.8, rated HIGH, and a security patch is available from Citrix under advisory CTX696604.
Because the vulnerability is listed in the KEV catalogue, active exploitation has been confirmed in the wild. No known ransomware campaign has been linked to this CVE to date. CISA has set a remediation deadline of 29 August 2026 for federal agencies to address the issue.
CISA’s required action is: “Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26‑04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s ‘Forensics Triage Requirements’ (see URL in Notes). Follow applicable BOD 26‑04 guidance for cloud services or discontinue use of the product if mitigations are unavailable.
Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26‑04 patching guidelines.” This directive binds Federal Civilian Executive Branch (FCEB) agencies; all other organisations should review their exposure to NetScaler ADC and Gateway and apply the patch or mitigations as soon as practicable.
For full technical details, refer to the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-8452 and the CISA KEV catalogue.