New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure

CVE-2026-8451 in Citrix NetScaler ADC and Gateway was actively weaponized by threat actors in under 24 hours after both a vendor patch and public technical details were released simultaneously — a dangerous combination that collapses the window organizations have to remediate. The vulnerability allows unauthenticated attackers to read arbitrary memory content from SAML IDP-configured appliances, exposing session tokens, credentials, and sensitive data without any login required. This incident underscores a recurring pattern where public proof-of-concept or technical write-ups accelerate exploitation timelines dramatically, leaving organizations with no buffer if they lack mature emergency patching processes. The speed of exploitation highlights that internet-facing infrastructure with known vulnerabilities must be treated as actively compromised until patched, and that passive monitoring of disclosure channels is no longer sufficient.