Summary
CVE-2026-8451 is a high-severity out-of-bounds read (memory overread) vulnerability in NetScaler ADC and NetScaler Gateway, caused by insufficient input validation in the SAML Identity Provider (SAML IDP) processing component. Rated CVSS 4.0 8.8 (HIGH), the flaw enables unauthenticated remote attackers to trigger a memory overread by sending crafted requests to the SAML IDP endpoint, potentially disclosing sensitive in-memory data including session tokens and credentials. Patches are available, and immediate remediation is strongly recommended.
Technical details
- Root cause: Insufficient input validation in the SAML IDP request-handling component (CWE-125: Out-of-Bounds Read)
- Trigger conditions: Exploitation requires the NetScaler appliance to be configured as a SAML IDP — a common enterprise configuration for SSO and identity federation with cloud services and SaaS platforms; no authentication or user interaction is required
- Attack vector: Network — an unauthenticated remote attacker can deliver crafted SAML requests to an internet-exposed appliance; SAML IDP endpoints are publicly reachable by design
- Confidentiality impact (HIGH): The memory overread can expose sensitive contents from the appliance’s address space, potentially including active session tokens, credentials, TLS key material, or application configuration data
- Availability impact (HIGH): The out-of-bounds read condition can affect appliance stability
- Threat context: A closely related predecessor vulnerability affecting the same attack surface — insufficient input validation in NetScaler ADC/Gateway as a SAML IDP leading to memory overread — was confirmed as actively exploited at scale, with exploitation confirmed by Fortinet and the vulnerability added to the CISA Known Exploited Vulnerabilities (KEV) catalog. This establishes confirmed threat-actor interest in this specific class of NetScaler SAML IDP memory overread vulnerability.
Affected software
- NetScaler ADC 14.1 before 14.1-72.61
- NetScaler ADC 13.1 before 13.1-63.18
- NetScaler Gateway 14.1 before 14.1-72.61
- NetScaler Gateway 13.1 before 13.1-63.18
- NetScaler ADC 14.1 FIPS before 14.1-72.61 FIPS
- NetScaler ADC 13.1 FIPS and NDcPP before 13.1-37.272 FIPS/NDcPP
Severity
CVSS 4.0 Base Score: 8.8 (HIGH)
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N
Mitigation and recommended actions
- Immediate — upgrade to the following patched releases:
- NetScaler ADC and NetScaler Gateway: 14.1-72.61 or later
- NetScaler ADC and NetScaler Gateway: 13.1-63.18 or later
- NetScaler ADC 14.1 FIPS: 14.1-72.61 FIPS or later
- NetScaler ADC 13.1 FIPS/NDcPP: 13.1-37.272 FIPS/NDcPP or later
- Audit all NetScaler deployments to identify appliances configured as a SAML IDP — those are the assets directly in scope for this vulnerability.
- Where immediate patching is not feasible, consider restricting network access to SAML IDP endpoints as a temporary risk-reduction measure until patching can be completed.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.