If you manage NetScaler appliances or on-premises SharePoint Server, this week has given you two separate reasons to cancel your holiday plans. On June 30, Citrix disclosed CVE-2026-8451, a pre-authentication memory disclosure in NetScaler ADC and Gateway that watchTowr Labs reported. On the same day, Microsoft's May patch for SharePoint Server CVE-2026-45659 was confirmed by CISA as actively exploited, with a July 4 deadline for federal agencies. Both vulnerabilities are serious. Both are being exploited now.
Citrix CVE-2026-8451: history repeats with a new memory leak
CVE-2026-8451 is a CVSS 8.8 flaw in NetScaler's custom XML parser for SAML AuthnRequest documents. The parser fails to terminate unquoted attribute values that are followed by a newline. This triggers an out-of-bounds read, and the leaked memory content is returned in the NSC_TASS cookie to whoever sent the request. No authentication required. The affected versions are NetScaler ADC and Gateway 14.1 before 14.1-72.61, and 13.1 before 13.1-63.18.
This is not a theoretical bug. Lupovis, a deception vendor, reported that its decoy infrastructure detected a coordinated scanning campaign within 24 hours of Citrix publishing the advisory. A single threat actor operating from IP address 146.70.139.154 (M247 Europe SRL, AS9009) targeted three separate Lupovis sensors over a five-hour window between June 30 and July 1. The actor sent requests to the POST /saml/login endpoint with malformed SAML request tags padded with hundreds of spaces. Once a sensor returned HTTP 200, the actor delivered a full exploitation payload. The user-agent was python-requests/2.32.5.
The pattern echoes the 2023 CitrixBleed incident, where session-token leaks from the same product family were used to breach Boeing and other large targets. watchTowr, which reported CVE-2026-8451, noted that the flaw lives in the same SAML handling code that produced the earlier vulnerability. Citrix now has two almost identical memory disclosure bugs in its SAML parser in three years. That should worry anyone running NetScaler in SAML IdP mode.
At the time of disclosure, neither Citrix nor watchTowr confirmed exploitation, and the CVE was not in CISA's Known Exploited Vulnerabilities catalog. But Lupovis data shows that attackers did not wait for that catalog entry. They read the advisory, grabbed the detection tool watchTowr released, and started scanning. The window between disclosure and active exploitation is now measured in hours, not days.
SharePoint CVE-2026-45659: Microsoft's optimism did not age well
CVE-2026-45659 is a deserialization vulnerability in SharePoint Server's list item handling path. The LosFormatter.Deserialize() method in Microsoft.SharePoint.Library processes attacker-supplied data without adequate validation. An attacker with a valid SharePoint account at Site Member permission level can reach remote code execution. No admin rights. No user interaction. The attacker runs code as the SharePoint service account, which in most enterprises means access to Active Directory, databases, and the internal network.
Microsoft shipped a fix for this in May 2026 and labeled it "Exploitation Less Likely" on its Exploitability Index. On July 1, CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities catalog. Federal agencies have until July 4 to patch under Binding Operational Directive BOD 26-04. That deadline arrives today.
This is the second time this year Microsoft has misjudged the exploitability of a SharePoint Server RCE. In January 2026, CVE-2026-20963 received the same "Exploitation Less Likely" rating. That vulnerability was also later confirmed exploited and added to the KEV list. The Register's July 2 headline captured the situation: "Microsoft said exploitation was 'less likely' but CISA just added SharePoint RCE to KEV list." At some point the pattern stops being a coincidence and starts being a methodology problem.
For anyone running SharePoint Server on-premises, the practical takeaway is to treat "Exploitation Less Likely" as a starting point for your own risk assessment, not as Microsoft's final word. Deserialization bugs in web frameworks tend to be reliably exploitable once a researcher or attacker works out the gadget chain. The fact that two separate SharePoint deserialization CVEs were both underestimated suggests the index underweights how quickly authenticated attackers turn these bugs into working exploits.
What both cases have in common
Two vulnerabilities. Two different product families. Two different attack surfaces. But they share the same pattern: the time between disclosure and exploitation is shrinking, and vendor risk labels are not keeping up.
For the Citrix flaw, watchTowr released a detection tool alongside the advisory. That gave defenders a starting gun, but it also gave attackers one. The Lupovis data shows that within 24 hours, someone was already delivering payloads against the /saml/login endpoint. If you rely solely on CISA's KEV catalog to prioritize patching, you miss the early exploitation phase entirely. CVE-2026-8451 is still not in that catalog as of today.
For the SharePoint flaw, Microsoft's own exploitability rating gave some organizations false confidence. If you saw "Exploitation Less Likely" in May and decided to defer the patch until your next maintenance window, you now have active exploitation to worry about. The CISA KEV entry makes that decision look unwise in retrospect.
What to do now
If you run NetScaler ADC or Gateway with SAML IdP enabled, install the fixed builds immediately. The versions to aim for are 14.1-72.61 or later, and 13.1-63.18 or later. Citrix says there are no effective workarounds, and the Lupovis data confirms that attackers are already probing for vulnerable instances. If you cannot patch right now, at least check your logs for repeated POST requests to /saml/login and for the NSC_TASS cookie being returned with unexpected content. The IP 146.70.139.154 and user-agent python-requests/2.32.5 are current IOCs, but expect other actors to use different infrastructure.
If you run SharePoint Server on-premises, check your build version and apply the May 2026 security update if you have not already. The CISA KEV entry makes this urgent regardless of Microsoft's prior rating. The July 4 deadline applies to federal agencies, but the reasoning applies to everyone: active exploitation is confirmed, and the vulnerability requires only a low-privilege SharePoint account to reach RCE. If you deferred patching because you judged the risk low, re-evaluate that judgment today.
The broader pattern
Edge devices and collaboration platforms are where attackers focus because they sit at the boundary between internal and external networks. NetScaler is a remote-access gateway. SharePoint is often the intranet hub. A compromise of either gives attackers a foothold with service-level privileges that can ripple across the environment.
We are seeing a trend where vendor exploitability assessments are unreliable for these products. Microsoft has now misjudged two SharePoint RCEs in six months. Citrix has produced a memory disclosure class that keeps reappearing in the same SAML code. Defenders cannot outsource risk prioritization to the vendor's index or to the CISA KEV catalog. They need to patch based on severity and exposure, not on someone else's label.
The practical advice is simple but time-consuming: inventory your NetScaler and SharePoint instances, verify the patch levels, and apply the fixes today. The next 24 hours will tell whether more Lupovis-style scanning campaigns are already running.