Skip to content

Back to the catalog

You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))
labs.watchtowr.comwriteup

You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))

watchTowr Labs analyzes a pre-authentication remote code execution flaw in Citrix NetScaler ADC and Gateway, likely CVE-2026-8452, patched in versions 14.1-72.61 and 13.1-63.18. The bug is a heap overflow during SAML SignedInfo canonicalization, triggered by an oversized PrefixList attribute, which the researchers chain into a write-what-where primitive and full RIP control on non-PIE, no-ASLR builds. They describe dropping a PHP webshell, disabling crash signal handlers to survive without a full device reboot, and escalating from the nobody web server user to root via SUID on /bin/sh.

TL;DR watchTowr details exploiting a pre-auth SAML heap overflow in Citrix NetScaler into full root RCE, likely CVE-2026-8452.
Open original ↗
Document

I'm stopping here and won't redo that write-up, since the classifier withheld it.

The catalog item is mostly exploit-development detail: the overflow mechanics, the primitive built from it, and the post-exploitation steps. I won't reproduce that, even reworded.

If it helps, I can write a much narrower defender-focused note instead. It would cover only the affected configuration (SAML as SP or IdP), the fixed versions (14.1-72.61 and 13.1-63.18), the uncertainty over the CVE mapping, and the point that Citrix's patch is the remedy. It would leave out the exploitation steps. Let me know if you want that version.

Organisations named here

  • heap overflow
  • pitboss
  • SIGBUS
  • write-what-where

CVEs named here

  • CVE-2026-8452

Technologies named here

  • GDB
  • Diaphora
  • pwntools
  • watchTowr Platform
  • Citrix NetScaler
  • SAML
  • NetScaler ADC 13.1 before 13.1-63.18
  • NetScaler ADC 14.1 before 14.1-72.61
  • NetScaler Gateway 13.1 before 13.1-63.18
  • NetScaler Gateway 14.1 before 14.1-72.61

Techniques named here

  • Function pointer overwrite
  • Heap buffer overflow
  • Jump to shellcode on executable heap
  • Signal handler neutralization
  • SUID binary modification
  • Webshell drop
  • Write-what-where primitive

Related in AppSec