[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fb7jccFpYglCZXflvs3e3IrzNq4wDCO6x3rUkLaBlP7g":3},{"article":4,"iocs":53,"watch_terms":58,"solutions":59,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"29834770-052a-4caf-8e4d-ab31d554608a","New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure","new-citrixbleed-vulnerability-exploited-immediately-after-public-disclosure-49aee2","Hackers are targeting NetScaler appliances using public PoC code to retrieve arbitrary memory content in the HTTP response. The post New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure appeared first on SecurityWeek.","Threat actors began exploiting CVE-2026-8451, a critical out-of-bounds read vulnerability in Citrix NetScaler ADC and Gateway appliances, less than 24 hours after Citrix released patches and watchTowr published technical details on June 30. The vulnerability allows unauthenticated attackers to retrieve arbitrary memory content from appliances configured as SAML IDP, with at least two threat actors observed probing and delivering payloads to exposed instances. Organizations are advised to patch immediately or disable SAML IDP, and monitor logs for \u002Fsaml\u002Flogin traffic and NSC_TASS cookie values.","CVE-2026-8451 CitrixBleed vulnerability exploited within 24 hours of public disclosure","https:\u002F\u002Fwww.securityweek.com\u002Fnew-citrixbleed-vulnerability-exploited-immediately-after-public-disclosure\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F01\u002FCybersecurity_News-SecurityWeek.jpg","2026-07-02T15:04:22+00:00","2026-07-02T16:00:25.36653+00:00",9,[17,20,22,25,27,29],{"name":18,"type":19},"Citrix NetScaler ADC","product",{"name":21,"type":19},"Citrix NetScaler Gateway",{"name":23,"type":24},"Citrix","vendor",{"name":26,"type":24},"watchTowr",{"name":28,"type":24},"Lupovis",{"name":30,"type":31},"CitrixBleed","campaign","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":55,"value":56,"context":57},"cve","CVE-2026-8451","Out-of-bounds read in NetScaler XML parser affecting SAML IDP configurations, CVSS 8.8",[23,26,28],{"controls":60,"vendors":143},[61,90,118],{"slug":62,"name":63,"problem":64,"products":65},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":91,"name":92,"problem":93,"products":94},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"detectify","Detectify","\u002Fvendor-logos\u002Fdetectify.png","surface-monitoring","Detectify Surface Monitoring","https:\u002F\u002Fdetectify.com\u002Fproduct\u002Fsurface-monitoring","Continuous discovery and testing of internet-facing subdomains and services.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"outpost24","Outpost24","\u002Fvendor-logos\u002Foutpost24.png","outpost24-easm","Outpost24 EASM","https:\u002F\u002Foutpost24.com\u002Fproducts\u002Fexternal-attack-surface-management\u002F","Discovery and risk assessment of internet-facing assets.",{"vendor_slug":112,"vendor_name":26,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"watchtowr","\u002Fvendor-logos\u002Fwatchtowr.png","watchtowr-platform","watchTowr Platform","https:\u002F\u002Fwatchtowr.com\u002Fplatform\u002F","Continuous discovery of internet-facing assets, with automated testing for exploitable vulnerabilities.",{"slug":119,"name":120,"problem":121,"products":122},"patch-management","Automated patch management","Known holes get closed in days, not months.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":119,"product_name":140,"url":141,"description":142},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",[144,149],{"slug":145,"name":23,"logo_path":146,"roles":147},"citrix","\u002Fvendor-logos\u002Fcitrix.png",[148],"affected",{"slug":112,"name":26,"logo_path":113,"roles":150},[151],"reported_by",{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":167},"citrixbleed-critical-vulnerability-exploited-within-24-hours-of-disclosure","CitrixBleed: Critical Vulnerability Exploited Within 24 Hours of Disclosure","CVE-2026-8451 in Citrix NetScaler ADC and Gateway was actively weaponized by threat actors in under 24 hours after both a vendor patch and public technical details were released simultaneously — a dangerous combination that collapses the window organizations have to remediate. The vulnerability allows unauthenticated attackers to read arbitrary memory content from SAML IDP-configured appliances, exposing session tokens, credentials, and sensitive data without any login required. This incident underscores a recurring pattern where public proof-of-concept or technical write-ups accelerate exploitation timelines dramatically, leaving organizations with no buffer if they lack mature emergency patching processes. The speed of exploitation highlights that internet-facing infrastructure with known vulnerabilities must be treated as actively compromised until patched, and that passive monitoring of disclosure channels is no longer sufficient.",[157,158,159,160,161,162,163,164,165,166],"CIS Control 7.1 – Establish and Maintain a Vulnerability Management Process","CIS Control 7.4 – Perform Automated Application Patch Management","CIS Control 12.1 – Ensure Network Infrastructure is Up-to-Date","NIST SP 800-40 Rev. 4 – Guide to Enterprise Patch Management Planning","NIST SI-2 – Flaw Remediation","NIST RA-5 – Vulnerability Monitoring and Scanning","NIST IR-4 – Incident Handling","ITIL 4 – Change Enablement (Emergency Change Procedure)","CISA KEV (Known Exploited Vulnerabilities Catalog) – Mandatory Remediation Directive","GDPR Article 32 – Security of Processing (timely remediation of known vulnerabilities)",{}]