Twelve days. Thirty-six exploitation attempts. Twelve attacker IPs. One edge appliance.
CVE-2026-8452 — Citrix NetScaler ADC and Gateway. CISA added it to the KEV catalog on August 26 with a three-day federal deadline. It is being exploited right now.
WHAT ACTUALLY HAPPENED
The flaw is a memory buffer violation in NetScaler ADC and Gateway. Telemetry from the campaign documented 36 exploitation attempts over 12 days, from 12 unique attacker IP addresses spread across multiple countries.
The attackers did not stop at crashing the box. They dropped web shells — files named x.php and z.php — and ran reconnaissance commands from the appliance itself.
Cisco Talos ties the activity to UAT-10147, a Chinese cybercrime group hitting Windows and Linux servers across education, media, technology and gaming worldwide.
Same product family that Anubis affiliates rode into Coca-Cola's Fairlife unit weeks earlier, via CitrixBleed 2 and stolen VPN credentials. That one suspended U.S. production and put 1 TB of data on a leak site.
WHY THE EDGE KEEPS LOSING
A NetScaler sits in front of everything and is trusted by everything behind it. It terminates TLS, brokers sessions, holds credentials in memory, and speaks to your internal network without crossing another control.
It also runs an appliance OS most teams never log, never EDR, and never inspect for a stray PHP file.
That combination is why the same three or four vendors keep appearing in KEV month after month. It is not that edge code is uniquely bad — it is that a web shell on an ADC survives your entire detection stack.
An appliance you cannot see inside is not a security control. It is an unmonitored server with a public IP.
WHAT TO DO NOW
PATCH NETSCALER TODAY — the KEV deadline was August 29, and exploitation is confirmed, not theoretical.
HUNT FOR WEB SHELLS — search the filesystem for x.php, z.php and any unexpected script, and review config for unauthorised changes.
ROTATE EVERYTHING THE APPLIANCE TOUCHED — sessions, service accounts, LDAP bind credentials and certificates, because patching does not evict an attacker who already has a shell.
SHIP APPLIANCE LOGS OFF-BOX — if your ADC telemetry only lives on the ADC, an attacker with root decides what you get to see.
Patching closes the door. It does not remove whoever is already inside.
When did you last look at what is actually running on your edge appliances — not just their version number?