Citrix Patches Critical NetScaler Vulnerabilities Linked to CitrixBleed

Citrix has issued a security bulletin on June 30, 2026, addressing six vulnerabilities in NetScaler ADC and Gateway appliances, including CVE-2026-8451, which has a CVSS score of 8.8. These vulnerabilities allow attackers to exploit memory overreads, arbitrary file access, and denial-of-service conditions. The most critical flaw, CVE-2026-8451, affects systems configured as SAML Identity Providers, commonly used for single sign-on. The vulnerabilities were discovered by researchers at watchTowr and others, with CVE-2026-3055 being previously identified and confirmed to be actively exploited. Citrix recommends immediate patching and configuration adjustments to mitigate risks. The vulnerabilities are part of a concerning trend in memory management issues within Citrix products. The overall severity of the bulletin is rated as high, with CVSS scores ranging from 6.9 to 8.8.

Key Points: • Citrix disclosed six vulnerabilities in NetScaler ADC and Gateway, with CVE-2026-8451 rated 8.8. • The vulnerabilities allow memory overreads, arbitrary file access, and denial-of-service conditions. • Immediate patching and configuration changes are recommended to mitigate risks.