Our automated tracking framework flagged that CISA added CVE-2026-8452 (Citrix NetScaler ADC and NetScaler Gateway) to the Known Exploited Vulnerabilities (KEV) catalog on August 27, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service. ”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-8452 by August 29, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-8452 |
| Vendor / product | Citrix NetScaler ADC and NetScaler Gateway |
| Vulnerability | Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability |
| CVSS base score | 9.8 |
| Added to KEV | August 26, 2026 |
| Days public before listing (NVD → KEV lag) | 57 |
| Federal patch deadline | August 29, 2026 |
| Known ransomware use | No |
How This Compares to Citrix’s Track Record
This one was public for just 57 days before CISA confirmed exploitation — faster than Citrix’s 183-day median, meaning attackers moved unusually quickly. Citrix currently ranks #25 on our KEV Lag leaderboard.
| Citrix in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 23 |
| Median lag (public → KEV listing) | 183 days |
| 0-day rate (exploited at or before disclosure) | 22% |
| Entries tied to known ransomware campaigns | 7 |
For perspective, the median across all 1681 tracked KEV entries is 267 days — Citrix’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent Citrix KEV Additions
The most recent Citrix vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-3055 | NetScaler | March 30, 2026 | 7 | No |
| CVE-2025-7775 | NetScaler | August 26, 2025 | 0 | No |
| CVE-2024-8068 | Session Recording | August 25, 2025 | 286 | No |
| CVE-2024-8069 | Session Recording | August 25, 2025 | 286 | No |
| CVE-2025-5777 | NetScaler ADC and Gateway | July 10, 2025 | 23 | ⚠️ Yes |
Defense guide: How to Detect DDoS Attack: Warning Signs & Defense Playbook — detection signals, attack chain and response steps for this class of attack.
What This Means for Defenders
CISA has added CVE-2026-8452, impacting Citrix NetScaler ADC and NetScaler Gateway, to its Known Exploited Vulnerabilities Catalog. With a critical CVSS base score of 9.8, federal agencies must patch by August 29, 2026. All organizations using these Citrix products should mirror this deadline, as the vulnerability presents immediate and widespread risk.
CVE-2026-8452 was publicly disclosed 57 days before its KEV listing on August 26, 2026. This relatively short window suggests exploitation began quickly after public disclosure. Organizations with internet-exposed Citrix NetScaler ADC and Gateway instances are particularly vulnerable and must prioritize patching.
If you can’t patch before the August 29 deadline, restrict access to affected systems immediately. Implement strict network segmentation and enhance monitoring for suspicious activity originating from or targeting these devices. Incident response readiness is paramount to detect and mitigate potential exploitation attempts while a permanent fix is prepared.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- WordPress’s CVE-2026-63030 Was Exploited in 4 Days — Well Under Its 420-Day Median (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
