Attackers Weaponize New CitrixBleed Flaw Almost Instantly After Reveal
CVE-2026-8451 (CVSS score of 8.8): Within less than a day of going public, a new CitrixBleed-type vulnerability impacting NetScaler ADC and NetScaler Gateway was already being actively exploited by threat actors, according to findings from Scottish security firm Lupovis.
The vulnerability stems from an out-of-bounds read flaw in NetScaler devices set up as SAML Identity Providers, resulting in the exposure of memory contents. The root cause lies in NetScaler's XML parser: it failed to properly stop reading unquoted XML attribute values when a newline character followed them. This parsing error caused the system to read beyond its allocated buffer, leaking memory data that was then embedded in the NSC_TASS cookie within an HTTP response. Although the appliance must be configured as a SAML IDP for the flaw to be exploitable, an attacker doesn't need valid credentials to carry out the attack.
The initial scanning traffic came from an IP address hosted on infrastructure based in Frankfurt, Germany, likely a temporary or specially built node used for scanning. Within a five-hour period, several Lupovis sensors were hit, and as soon as one sensor returned a 200 response, an attacker immediately delivered a payload to it. That payload consisted of an empty AuthnRequest tag stuffed with 476 spaces and ending in a newline character—matching the overread pattern generated by watchTowr's detection tool. By Thursday, Lupovis had identified a separate threat actor scanning for vulnerable NetScaler systems, this time from an IP address linked to Koapu Cloud HK. According to Lupovis CEO Xavier Bellekens, both attackers followed an identical pattern: they searched for the correct endpoint, and as soon as they got a 200 OK response with the expected content, they deployed their payload without delay.
Defense
To defend against this threat, organizations should apply patches to their NetScaler appliances as soon as possible, or turn off SAML IDP functionality if patching isn't immediately feasible. Additionally, security teams should review logs for activity on the /saml/login endpoint, examine the values within those requests, and monitor NSC_TASS cookie contents to detect signs of exploitation.
