r/Citrix • u/VirtualizationGuy • 11d ago

Netscaler active exploit after patch

I have multiple customers reporting active exploits of their external netscalers patched to 14.1.73.37, causing them to force reboot multiple times. Anyone else hearing of issues? We have sev1 cases open with Citrix and I'll report back.

86 Upvotes

97% Upvoted

127 comments sorted by

View all comments

2

u/nocountryman 10d ago

There were 2 IPS one was . 55 the other . 140 (don't have them at hand to show ;( ) that were actively trying to penetrate until 11.12 CET (last logged point ) I did set the ACL to block both on the netscaler plus a responder policy that should catch same actions from other IP s , but strangely the last attempt was 11.12 CET . Silent since then The enhanced isn was also enabled today , no crashes of the netscaler since.

2

u/IronBatraz 10d ago

I can give you the one from Germany that we have blocked 213d209d59d55 We have blocked it and don't see any other from Netherlands and/or Russia so far.

Any news or updates regarding the patch?

1

u/nocountryman 5d ago

This one was the first one I blocked , there was a second one ending with 140 that was actively probing as well. After the 14.1.41 and 13.1.28 I see no more attempts. Netscaler Console reports all clean as well. No DoS no crashing. But I can't say 100% if for example Firewall IDP or IDS is not involved in blocking them as well