New CitrixBleed-like NetScaler flaw sees exploit attempts in the wild

A newly discovered vulnerability in Citrix NetScaler appliances, tracked as CVE-2026-8451, has already seen exploit attempts in the wild. This memory overread flaw is similar to the previously disclosed CitrixBleed vulnerabilities, which have been a target for attackers since 2023. The latest vulnerability was identified by researchers at watchTowr, who published a detailed analysis of the issue, including how unauthenticated malformed requests can be used to exploit it¹. Citrix has released a patch for the vulnerability, but the swift appearance of exploit attempts suggests that attackers are actively seeking to capitalize on the flaw. The CVE-2026-8451 disclosure highlights the need for organizations to prioritize patching based on their exposure and evidence of exploitation. This vulnerability matters to practitioners because it expands the active attack surface, making it essential to take prompt action to mitigate potential risks.