CVE-2026-8451 - Insufficient input validation leading to memory overread

Back Back to CVE browser

HIGH

Insufficient input validation leading to memory overread

Published Jun 30, 2026

8.8

HIGH

CVSS 4.0

EPSS 0.50%

Description

Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML IDP

Affected products

Vendor NetScaler Product ADC Default
unaffected
- Version
  13.1
  Status
  affected
  Constraints
  <63.18
- Version
  13.1 FIPS and NDcPP
  Status
  affected
  Constraints
  <37.272
- Version
  14.1
  Status
  affected
  Constraints
  <72.61
- Version
  14.1 FIPs
  Status
  affected
  Constraints
  <72.61
Vendor NetScaler Product Gateway Default
unaffected
- Version
  13.1
  Status
  affected
  Constraints
  <63.18
- Version
  14.1
  Status
  affected
  Constraints
  <72.61

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

NetScaler

ADC

unaffected

Version	Status	Constraints
13.1	affected	<63.18
13.1 FIPS and NDcPP	affected	<37.272
14.1	affected	<72.61
14.1 FIPs	affected	<72.61

NetScaler

Gateway

unaffected

Version	Status	Constraints
13.1	affected	<63.18
14.1	affected	<72.61

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40305
Advisory
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-40305		Advisory
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604		Vendor Advisory