Citrix NetScaler appliances mein ek nai samne aai CitrixBleed-class ki kamzori public discloser ke ek din se bhi kam samay mein active exploitation ke tahat aa gai, jisme decoy infrastructure operator Lupovis ne teen alg-alg sensor deployment mein ek coordinated scaning-and-exploitation campen ki pushti ki.
Citrix ke advisory CTX696604 publish karne aur watchTowr Labs ke CVE-2026-8451 ke liye ek detection artifact generator release karne ke 24 ghante ke ander, Lupovis decoy infrastructure ne SAML identity providers ke roop mein configar kiye gaye NetScaler appliances ko target karne wale ek coordinated scanning campen ka pata lagaya.
CitrixBleed Vulnerability Exploited
CVE-2026-8451 smriti-prakatikaran doshon ke CitrixBleed parivar mein navintam pravishti hai, NetScaler upkaranon mein smriti prabandhan vifaltaon ki ek aavarti shreni jise pehle CVE-2023-4966 ke saath pehchana gaya tha aur CVE-2025-5777, CVE-2025-12101 aur CVE-2026-3055 sahit kramik CVE mein phir se khoja gaya tha.
Yeh history ek jaisa pattern dikhati hai: CitrixBleed-style bugs bina authentication wale, sation-token dikhane wale kamiyan hain jo ek baar pata chalne par tezi se bade paimane par istemaal kiye jaate han, jaisa ki 2023 mein original CitrixBleed ke saath dekha gaya tha, jab hackers ne pata chalne ke kuch hafton ke andar boing, ICBC aur DP world par hamla kiya tha.
New Vulnerability SAML AuthnRequest documents ke liye NetScaler ke custom XML parsar mein hai, jo bina coat kiye gaye atribute value ko khatm karne mein fail ho jata hai, jiske baad ek nai line aati hai, jisse ek out-off-bounds read hota hai jiska content NSC_TASS cookie mein leak ho jata hai.
Kyunki CVE-2026-8451 ka upyog iske KEV listing se pehle ka hai, isliye puri tarah se KEV-sanchalit patch prathmikta par nirbhar sangathan is window ke dauran CitrixBleed 2 samayarekha ke dohrav ke sampark mein the, jahan upyog 20 june 2025 ke aaspaas shuru hua tha, lekin KEV samaveshan 10 july tak nahin hua tha.