CVE-2026-8451 Out-of-Bounds Read Exploited in NetScaler SAML IDP Within 24 Hours

Lupovis sensors recorded initial scans from a Frankfurt IP five hours after watchTowr published the detection artefact generator. The payload matched the overread variant exactly: a bare samlp:AuthnRequest tag padded with 476 spaces and a newline, triggering memory disclosure via the NSC_TASS cookie. A second actor from Koapu Cloud HK repeated the pattern within days, confirming rapid weaponization of the unauthenticated XML parser flaw.

Procurement records show NetScaler appliances remain core to enterprise SAML and VPN infrastructure despite repeated memory-disclosure issues since 2023. The absence of authentication requirements and the direct path to credential material in the cookie align with observed ransomware supply-chain tactics that prioritize identity provider compromise over perimeter breaches.

No state attribution is supported by the technical evidence; the scanning infrastructure and payload delivery match opportunistic criminal tooling. Official Citrix advisory emphasizes patching or disabling SAML IDP, yet log analysis guidance for /saml/login and NSC_TASS values remains the only immediate detection method available to operators.

Next indicators will appear in ransom group infrastructure reuse of harvested SAML assertions and in follow-on exploitation of unpatched appliances still reachable from the public internet.