CitrixBleed Vulnerability Exploitation Within 24 Hours of Disclosure

**Executive summary:** Citrix NetScaler appliances configured as SAML Identity Providers are being actively exploited in the wild via CVE-2026-8451 (CVSS 8.8), a memory-disclosure flaw in the XML/SAML parser that allows unauthenticated attackers to retrieve sensitive memory (observable via anomalous NSC_TASS cookies); Lupovis telemetry links a targeted campaign (IP 146.70.139.154, python-requests/2.32.5) delivering base64‑encoded, whitespace‑padded SAMLRequest payloads against POST /saml/login—organizations should urgently patch affected versions or disable SAML IdP and search logs dating back to June 30, 2026 for related activity.