Citrix NetScaler CVE-2026-8452 Active Pre-Auth RCE Threat Hunt

Threat Overview

CVE-2026-8452 is a memory-overflow vulnerability affecting customer-managed NetScaler ADC and NetScaler Gateway appliances configured as a Gateway or AAA virtual server. Subsequent watchTowr research demonstrated that the flaw can be weaponized for unauthenticated remote code execution as root.

CISA added CVE-2026-8452 to the Known Exploited Vulnerabilities catalog on August 26, 2026. Public reporting on August 27 described attackers dropping web shells such as x.php and z.php and running discovery commands including id and echo after exploitation.

References

• BleepingComputer — August 27, 2026
• Canadian Centre for Cyber Security — updated August 26, 2026
• NHS England Digital — Active Exploitation of CVE-2026-8452
• NVD — CVE-2026-8452

Impacted Systems

Vendor	Citrix / NetScaler
Products	NetScaler ADC and NetScaler Gateway
Affected versions	14.1 before 14.1-72.61; 13.1 before 13.1-63.18
FIPS / NDcPP	14.1-FIPS before 14.1-72.61 FIPS; 13.1-FIPS and 13.1-NDcPP before 13.1-37.272
Configuration prerequisite	Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server
Deployment	Customer-managed NetScaler; Citrix-managed cloud services are provider-remediated
EOL	NetScaler 13.0 is end-of-life and should be upgraded to a supported release
Highest-risk exposure	Internet-facing Gateway / AAA services
Known exploitation	Confirmed; CISA KEV

What this hunt looks for

Looks for suspicious requests and web-shell access on NetScaler systems, including reported x.php and z.php artifacts, rare POST activity, and discovery or shell commands in NetScaler syslog.

Required logs

CommonSecurityLog and/or Syslog from NetScaler, WAF, firewall, or reverse-proxy sources.

First-Pass — Reported NetScaler Web Shell Paths

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DeviceVendor has_any ("Citrix","NetScaler") or DeviceProduct has_any ("NetScaler","ADC","Gateway") or DestinationHostName has_any ("netscaler","citrix")
| where RequestURL has_any ("/x.php","/z.php")
| project TimeGenerated, SourceIP, DestinationHostName, DestinationPort, RequestMethod, RequestURL, RequestClientApplication, DeviceAction, Message
| sort by TimeGenerated asc

Follow-Up — Rare POST Requests to NetScaler Gateway / AAA

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DeviceVendor has_any ("Citrix","NetScaler") or DeviceProduct has_any ("NetScaler","ADC","Gateway") or DestinationHostName has_any ("netscaler","citrix")
| where RequestMethod =~ "POST"
| summarize Requests=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), URLs=make_set(RequestURL,50), UserAgents=make_set(RequestClientApplication,20), Actions=make_set(DeviceAction,20) by SourceIP, DestinationHostName
| sort by Requests asc

Follow-Up — Suspicious NetScaler Syslog Discovery or Shell Activity

Syslog
| where TimeGenerated >= ago(30d)
| where Computer has_any ("netscaler","citrix") or SyslogMessage has_any ("NetScaler","Citrix ADC","Gateway")
| where SyslogMessage has_any ("x.php","z.php"," id ","echo ","/bin/sh","/bin/bash","curl ","wget ")
| project TimeGenerated, Computer, HostIP, ProcessName, SeverityLevel, SyslogMessage
| sort by TimeGenerated asc