CISA’s alert
On August 26, 2026, CISA added six vulnerabilities to the KEV catalog. Among them is CVE-2026-8452 in Citrix NetScaler ADC and Gateway: improper restriction of operations within the bounds of a memory buffer, scored CVSS 9.8.
Exploitation speed
Per CVEDaily, the flaw was public for about 57 days before the KEV listing — well below Citrix’s historical median (~183 days). The federal BOD deadline was August 29, 2026, only 3 days after listing. Known ransomware use was not flagged then, but internet-facing NetScaler remains a frequent target.
What to do
Apply Citrix’s patch immediately on exposed ADC/Gateway, review access logs and treat any unpatched appliance as an incident priority. In August, Citrix was back at the center of the exploitation radar.