Citrix patches a new NetScaler flaw with echoes of CitrixBleed | CyberScoop<\/title> <meta name=\"description\" content=\"Citrix patched six NetScaler flaws, headlined by a high-severity memory disclosure bug (CVE-2026-8451) with striking similarities to CitrixBleed.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/citrix-netscaler-flaw-cve-2026-8451-citrixbleed\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Citrix patches a new NetScaler flaw with echoes of CitrixBleed\"> <meta property=\"og:description\" content=\"Citrix patched six NetScaler flaws, headlined by a high-severity memory disclosure bug (CVE-2026-8451) with striking similarities to CitrixBleed.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/citrix-netscaler-flaw-cve-2026-8451-citrixbleed\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cyberscoop\/\"> <meta property=\"article:published_time\" content=\"2026-06-30T21:46:38+00:00\"> <meta property=\"article:modified_time\" content=\"2026-06-30T21:52:23+00:00\"> <meta name=\"author\" content=\"Greg Otto\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/citrix-patches-a-new-netscaler-flaw-with-echoes-of-citrixbleed-2.jpg\"> <meta name=\"twitter:creator\" content=\"@gregotto\"> <meta name=\"twitter:site\" content=\"@CyberScoopNews\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1778775768g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1782841954g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1782279570g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=9519dd464d894b805a10\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/89651\"><meta name=\"generator\" content=\"WordPress 6.8.5\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=89651\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fcitrix-netscaler-flaw-cve-2026-8451-citrixbleed%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fcitrix-netscaler-flaw-cve-2026-8451-citrixbleed%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"wp-singular post-template-default single single-post postid-89651 single-format-standard wp-theme-scoopnewsgroup wp-child-theme-cyberscoop\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/citrix-netscaler-flaw-cve-2026-8451-citrixbleed\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"26.228571428571\">\n<div class=\"single-article__header-content\" readability=\"35.516290726817\">\n<p> The bulletin includes six NetScaler issues, but attention is centered on a high-severity flaw with similarities to earlier actively exploited bugs. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/89651\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"424\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/citrix-patches-a-new-netscaler-flaw-with-echoes-of-citrixbleed.jpg?resize=640%2C424&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/citrix-patches-a-new-netscaler-flaw-with-echoes-of-citrixbleed-2.jpg 5729w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/citrix-patches-a-new-netscaler-flaw-with-echoes-of-citrixbleed-2.jpg?resize=300,199 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/citrix-patches-a-new-netscaler-flaw-with-echoes-of-citrixbleed-2.jpg?resize=768,509 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/citrix-patches-a-new-netscaler-flaw-with-echoes-of-citrixbleed-2.jpg?resize=1024,679 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/citrix-patches-a-new-netscaler-flaw-with-echoes-of-citrixbleed-2.jpg?resize=1536,1019 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/citrix-patches-a-new-netscaler-flaw-with-echoes-of-citrixbleed-2.jpg?resize=2048,1358 2048w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/citrix-patches-a-new-netscaler-flaw-with-echoes-of-citrixbleed-2.jpg?resize=600,398 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/citrix-patches-a-new-netscaler-flaw-with-echoes-of-citrixbleed-2.jpg?resize=253,168 253w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/citrix-patches-a-new-netscaler-flaw-with-echoes-of-citrixbleed-2.jpg?resize=508,337 508w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/citrix-patches-a-new-netscaler-flaw-with-echoes-of-citrixbleed-2.jpg?resize=1018,675 1018w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/citrix-patches-a-new-netscaler-flaw-with-echoes-of-citrixbleed-2.jpg?resize=1271,843 1271w\" sizes=\"(max-width: 1018px) 100vw, 1018px\"><figcaption> Citrix rated the overall bulletin severity as high and assigned CVSS scores ranging from 6.9 to 8.8 across the six CVEs. (Photo by Justin Sullivan\/Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"26.18410041841\"><body readability=\"53.271260086903\"><\/p>\n<p>Citrix <a href=\"https:\/\/support.citrix.com\/support-home\/kbsearch\/article?articleNumber=CTX696604\">published a security bulletin<\/a> Tuesday disclosing six vulnerabilities in NetScaler ADC and NetScaler Gateway appliances, including a high-severity memory disclosure flaw that researchers say belongs to a vulnerability class first identified in the 2023 incident known as <a href=\"https:\/\/cyberscoop.com\/tag\/citrixbleed\/\">CitrixBleed<\/a>.<\/p>\n<p>The company rated the overall bulletin severity as high and assigned <a href=\"https:\/\/cyberscoop.com\/tag\/cvss\/\">CVSS<\/a> scores ranging from 6.9 to 8.8 across the six CVEs. Citrix said customers should install the updated builds and, in one case, manually adjust a configuration parameter even after patching.<\/p>\n<p>The most closely scrutinized of the vulnerabilities, <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-8451\">CVE-2026-8451<\/a>, was discovered by researchers at <a href=\"https:\/\/cyberscoop.com\/tag\/watchtowr\/\">watchTowr<\/a>, a cybersecurity firm that has published several prior analyses of issues in NetScaler products. <a href=\"https:\/\/labs.watchtowr.com\/citrixbleed-to-infinity-and-beyond-citrix-netscaler-pre-auth-memory-overread-cve-2026-8451\/\">According to a technical writeup<\/a> the firm released alongside Tuesday\u2019s disclosure, the vulnerability stems from how NetScaler parses SAML authentication requests when an appliance is configured as a SAML identity provider, a deployment mode commonly used for single sign-on.<\/p>\n<p>WatchTowr researcher Aliz Hammond wrote that the firm found the flaw in late March while reproducing a separate vulnerability, CVE-2026-3055, that Citrix disclosed earlier this year. That March flaw was <a href=\"https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog?search=CVE-2026-3055&field_date_added_wrapper=all&field_cve=&sort_by=field_date_added&items_per_page=20&url=\">added to CISA\u2019s Known Exploited Vulnerabilities<\/a> catalog after researchers and the agency confirmed active exploitation within days of disclosure. The new flaw shares a root cause with the March bug: both involve out-of-bounds memory reads triggered by malformed SAML requests sent to NetScaler\u2019s authentication endpoints.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>\u201cReferencing what we wrote previously, because it is demonstrably evergreen: \u2018However, what should be of concern is the bigger picture \u2013 the trend, which is very clearly suggesting that memory management continues to appear fragile within <a href=\"https:\/\/cyberscoop.com\/tag\/citrix\/\">Citrix<\/a> NetScaler appliances, to the extent that even accidentally misconfiguring an appliance can lead to the disclosure of leaked memory,\u2019\u201d Hammond wrote in the report. <\/p>\n<p>The bulletin also discloses five additional vulnerabilities affecting different NetScaler subsystems. Two involve memory overflow conditions that could cause denial-of-service outcomes. A separate flaw could allow unauthenticated arbitrary file reads on appliances where management access is exposed on certain network interfaces. Another concerns memory overread triggered through TCP timestamp handling. The sixth involves a denial-of-service condition tied to malformed HTTP\/2 requests, which requires an additional manual configuration change to fully fix, since the relevant timeout parameter defaults to a value that leaves the underlying condition unaddressed unless administrators set it explicitly.<\/p>\n<p>Along with Hammond, the bulletin credits Michael Tucker of the XOR team at JPMorgan Chase and Maxim Suhanov for finding the vulnerabilities. <\/p>\n<p>The NetScaler product line has accumulated more than 20 entries in <a href=\"https:\/\/cyberscoop.com\/tag\/cybersecurity-and-infrastructure-security-agency-cisa\/\">CISA<\/a>\u2019s KEV catalog over the past three years, including multiple flaws that have been weaponized in ransomware campaigns. As of Tuesday, the latest vulnerability had not joined that list \u2014 neither the vendor bulletin nor watchTowr\u2019s writeup cited confirmed exploitation at the time of disclosure.<\/p>\n<p> <\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"3.8186356073211\">\n<div class=\"author-card\" readability=\"14\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2026\/06\/citrix-patches-a-new-netscaler-flaw-with-echoes-of-citrixbleed-1.jpg?w=640&ssl=1\" alt=\"Greg Otto\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by Greg Otto<\/h4>\n<p> Greg Otto is Editor-in-Chief of CyberScoop, overseeing all editorial content for the website. Greg has led cybersecurity coverage that has won various awards, including accolades from the Society of Professional Journalists and the American Society of Business Publication Editors. Prior to joining Scoop News Group, Greg worked for the Washington Business Journal, U.S. News & World Report and WTOP Radio. He has a degree in broadcast journalism from Temple University. <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/citrix-netscaler-flaw-cve-2026-8451-citrixbleed\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Citrix patches a new NetScaler flaw with echoes of CitrixBleed<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4133,4572,3669,452,288,643],"tags":[4137,4574,3670,454,294,645],"class_list":["post-8790","post","type-post","status-publish","format-standard","hentry","category-citrix","category-citrixbleed","category-cvss","category-cybersecurity-and-infrastructure-security-agency-cisa","category-threats","category-vulnerabilities","tag-citrix","tag-citrixbleed","tag-cvss","tag-cybersecurity-and-infrastructure-security-agency-cisa","tag-threats","tag-vulnerabilities"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/citrix\/\" rel=\"category tag\">Citrix<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/citrixbleed\/\" rel=\"category tag\">CitrixBleed<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cvss\/\" rel=\"category tag\">CVSS<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity-and-infrastructure-security-agency-cisa\/\" rel=\"category tag\">Cybersecurity and Infrastructure Security Agency (CISA)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/threats\/\" rel=\"category tag\">Threats<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/vulnerabilities\/\" rel=\"category tag\">vulnerabilities<\/a>","tag_info":"vulnerabilities","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/8790","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=8790"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/8790\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=8790"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=8790"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=8790"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":8790,"date":"2026-06-30T16:46:38","date_gmt":"2026-06-30T21:46:38","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=89651"},"modified":"2026-06-30T16:46:38","modified_gmt":"2026-06-30T21:46:38","slug":"citrix-patches-a-new-netscaler-flaw-with-echoes-of-citrixbleed","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2026\/06\/30\/citrix-patches-a-new-netscaler-flaw-with-echoes-of-citrixbleed\/","title":{"rendered":"Citrix patches a new NetScaler flaw with echoes of CitrixBleed"},"content":{"rendered":"