Citrix credits JPMorgan, pushes fixes for six ugly NetScaler bugs

Citrix has credited a member of JPMorganChase’s cybersecurity team for disclosing severe security vulnerabilities in its Netscaler network software.

That’s the first such attribution that The Stack has seen for a major bank and, it understands, the first public credit for a security disclosure that names America’s largest bank – which has quietly disclosed previous issues.

Citrix credited “Michael Tucker from the XOR team at JPMorgan Chase, Aliz Hammond of watchTowr, and Maxim Suhanov” after pushing patches on June 30 for six vulnerabilities in its NetScaler ADC and NetScaler Gateway.

CitrixBleed v10?

Four of the vulnerabilities (three of which are rated CVSS 8.8) are memory issues; the kind of bug exploited in 2023’s endemic “CitrixBleed” attacks.

They have been allocated CVE-2026-8451, CVE-2026-8452, and CVE-2026-8655. The fourth is CVE-2026-10817. Preconditions for their exploitation and versions affected can be found in Citrix’s advisory. 

(NetScaler appliances exposed to CitrixBleed were exploited at scale by threat groups abusing CVE-2023-4966, a bug that let attackers grab valid session tokens from internet-facing Netscaler devices’ memory. These could be used to hijack active sessions, bypassing multi-factor authentication.)

See also: 1 Citrix bug alone triggered 13 “nationally significant” UK cybersecurity incidents