On 30 June 2026, Citrix rated CVE-2026-8452 as a memory overflow. On 14 August, WatchTowr showed it leads to pre-authentication code execution, and on 26 August CISA added it to the KEV catalog with a 29 August deadline. Appliances configured as VPN or AAA servers must be patched today, without waiting for official confirmation of exploitation.

On August 19, 2026, Cloud Software Group published a bulletin for NetScaler ADC and NetScaler Gateway: CVE-2026-19490, a CVSS 9.3 authentication bypass exploitable remotely without credentials, and CVE-2026-19489, an 8.8 denial-of-service. Any internet-facing appliance needs an emergency upgrade, after triage driven by the SAML or vserver configuration.