CVE-2026-8451
Insufficient input validation leading to memory overread
Updated
- CVSS 4.0
- 8.8 HIGH
- EPSS
- 14.2% (97th pct)
- CISA KEV
- Not listed
- Published
- 2026-06-30
- Weakness
- CWE-125
Description
Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML IDP
Key Findings
as of 2026-11-12- Its current EPSS score (14.2%) is higher than that of 29% of CISA KEV entries.
Severity
CVSS 4.0 · CNA · CVSS-B8.8 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:NOpen in CVSS calculator SSVC · CISA-ADP
Exploitationnone
Automatableyes
Technical impacttotal
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| NetScaler | NetScaler ADC | 14.1 to <72.61 13.1 to <63.18 14.1 FIPs to <72.61 13.1 FIPS and NDcPP to <37.272 |
| NetScaler | NetScaler Gateway | 14.1 to <72.61 13.1 to <63.18 |
References
1 linksRecord Details
- Published
- 2026-06-30
- Last updated
- 2026-06-30
- Assigner (CNA)
- NetScaler
- Credited to
- -
More from NetScaler
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). Alert titles and links from CISA cybersecurity alerts. This site is not affiliated with or endorsed by MITRE, NVD, CISA, or FIRST.