Citrix Patches NetScaler Vulnerabilities, Including New ‘HTTP/2 Bomb’ Attack

Citrix has released security updates for NetScaler ADC and NetScaler Gateway that fix six vulnerabilities, including the newly discovered HTTP/2 Bomb denial-of-service flaw. The most concerning issue is CVE-2026-8451, described as the latest in the CitrixBleed series, which could allow attackers to leak sensitive data from vulnerable appliances and potentially achieve full device compromise. Organizations with self-managed NetScaler deployments are strongly urged to apply these patches immediately, particularly those with SAML IDP configurations enabled.