SAML

CISA Adds CVE-2026-8452 to KEV Catalog and Orders Federal Agencies to Patch Citrix NetScaler by August 29 2026

CISA has placed CVE-2026-8452 in its Known Exploited Vulnerabilities catalog, compelling US federal agencies to apply patches to Citrix NetScaler before the unusually tight deadline of August 29 2026. The flaw, initially reported as a memory overflow leading to denial of service, has been confirmed through public technical analysis to enable unauthenticated remote code execution with root privileges on unpatched devices. The vulnerability impacts NetScaler ADC and NetScaler Gateway appliances configured as VPN Gateway or AAA virtual servers, with heightened risk in SAML-based deployments acting as either Service Provider or Identity Provider. Attackers have already conducted spray-and-pray campaigns that deploy webshells and perform basic reconnaissance after initial compromise. Tens of thousands of NetScaler instances remain internet-exposed, increasing the likelihood of automated mass exploitation. Citrix has released fixed builds including 14.1-72.61, 13.1-63.18, and 13.1-37.272 or higher for FIPS and NDcPP environments. Organizations are advised to inventory exposed devices, verify versions, hunt for indicators of compromise, and apply additional hardening measures beyond patching.

CISA Orders Federal Agencies to Patch Critical Citrix NetScaler RCE Flaw by August 29 2026

CISA has added CVE-2026-8452 to its Known Exploited Vulnerabilities catalog and set an unusually tight deadline for U.S. federal agencies to remediate the issue in Citrix NetScaler products. The vulnerability, initially described as a denial-of-service condition, is now actively exploited to achieve unauthenticated remote code execution with root privileges on unpatched appliances. Affected configurations include NetScaler ADC and NetScaler Gateway when deployed as VPN Gateway or AAA virtual servers, especially in environments using SAML for single sign-on. Attackers have been observed deploying webshells and performing reconnaissance after initial compromise in a spray-and-pray pattern. Tens of thousands of NetScaler devices remain exposed to the internet, increasing the risk of widespread automated attacks. Citrix has released fixed builds including 14.1-72.61 and 13.1-63.18, along with specific versions for FIPS and NDcPP environments.

GitHub Experiences Major Global Outage Affecting API, Actions, Copilot and Multiple Core Services

On August 17, GitHub suffered a widespread outage that impacted nearly all major platform functions including the web interface, API, Issues, Pull Requests, Actions, Webhooks, Pages, Git Operations, and Copilot. Approximately 20% of requests to the site and API failed during peak impact, with archive and raw repository content loads reaching around 50% error rates. Corporate authentication mechanisms such as SAML and OIDC, along with SCIM and Team Sync services, were also disrupted while Codespaces remained operational. The incident began around 13:40 UTC with progressive degradation across components, prompting GitHub to identify and mitigate the root cause. Services are gradually recovering but error rates remain slightly elevated, and the incident has not yet been fully closed. Parallel issues were reported in other Microsoft services including Teams and Copilot, with unconfirmed speculation linking the event to Amazon Web Services network problems.