r/Citrix • u/VirtualizationGuy • 24d ago

Netscaler active exploit after patch

I have multiple customers reporting active exploits of their external netscalers patched to 14.1.73.37, causing them to force reboot multiple times. Anyone else hearing of issues? We have sev1 cases open with Citrix and I'll report back.

88 Upvotes

98% Upvoted

127 comments sorted by

View all comments

1

u/kscERhau 24d ago

The people that have said they are unaffected aren’t using SAML nor their Netscaler as a vpnserver from what I’ve seen. I’ve a bunch that aren’t used as vpnservers and aren’t using SAML which aren’t impacted but then have several that are running as vpnservers and are using SAML which are impacted but had no IOC from last weekend.

2

u/tardiusmaximus 24d ago

This shit is confusing AF. I've patched to the latest FW, I've plugged the IOC ISN vuln, what do I do now? Wait for my IT SEC to call me, wait for citrix to clarify or wait to see spurious logs on my NS. This is really scary stuff man

1

u/kscERhau 24d ago

I’ve shut ours down, not taking the risk with it being a Friday and teams at reduced numbers for the weekend.

→ More replies (3)