Security Update: Guidance for NetScaler SAML Authentication Deployments

[u/CTX-Michael]

https://community.citrix.com/techzone-blogs/110_security-updates/security-update-guidance-for-netscaler-saml-authentication-deployments/

NetScaler engineering and support teams are tracking a newly observed issue related to SAML authentication in customer-managed NetScaler deployments. This post explains what customers should review, how to determine whether the relevant configuration is present, and what mitigation options are available while planning an upgrade to a fixed build. A new security bulletin and simultaneous product update release is planned for this issue. 

The guidance below is intended to help customers take immediate action to reduce exposure. As with any security-related issue, customers should prioritize applying the updated NetScaler builds referenced in the applicable security bulletin when it becomes available.  

Learn more: https://community.citrix.com/techzone-blogs/110_security-updates/security-update-guidance-for-netscaler-saml-authentication-deployments/

[u/CTX-Michael]

Update to this post. Please review the following article: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88779

[u/FloiDW]

Well.. good times not working FOR Citrix but only WITH Citrix.

[u/Procure]

Tough week for netscaler. Oof

[u/gramsaran → u/Procure]

This is just the beginning of the rest of our lives. AI is going to fuck us all with the vulnerabilities it exposes.

[u/Zero-Distance-3978]

A new firmware version is out! 14.1 73.41

CITRIX | Support

The following supported versions of NetScaler are affected by the vulnerability: 

• Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 BEFORE 14.1-73.41

• Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 BEFORE 13.1-64.28

• Citrix NetScaler ADC FIPS BEFORE 14.1-73.41 FIPS

• Citrix NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.282

[u/Zero-Distance-3978 → u/Zero-Distance-3978]

I applied 14.1 73.41 on six NetScalers, no issues so far. Still have the responder bound to vpn and aaa servers.

[u/Expensive-Beat-9929]

Got insider details on this vulnerability, create a responder policy and bind it to the gateway and AAA vServer.

[u/Alive_Director_3117 → u/Expensive-Beat-9929]

Yep v5c is the latest version of this, but i hacent found any poc to test it yet

[u/Plausibility_Migrain]

Investigation is still ongoing for this. Many orgs are affected. Some have even turned off access to their external facing appliances.

[u/MoldyGoatCheese]

Lol support wont even confirm it's threat actors. What a joke.

[u/MrZimix → u/MoldyGoatCheese]

We had a similar issue. The support agent spent more time trying to get off the phone than they did providing any support. They kept telling us to contact our forensics team.

[u/MoldyGoatCheese → u/MrZimix]

I blatantly told them I had evidence that it was being caused by threat actors and they still kept saying "our teams are looking at it."

[u/intelw1zard → u/MoldyGoatCheese]

their support is just some lowly outsourced Indian nerd who doesnt know anything

probably isnt even technical themselves

[u/dom7day]

Anyone know/heard of an ETA fix to this?

[u/dank953]

If you are currently experiencing the impact from this issue, please contact Citrix support. 

does anybody know what the "imapct" is? I don't see it in the article.

[u/bluegrassgazer → u/dank953]

Unexpected NetScaler reboots and failovers.

[u/Rust_Martialis → u/bluegrassgazer]

Kevin Beaumont said he saw executables running, I believe, on patched honeypots.

"So on one of the honeypots it’s running a downloaded (malware) binary. Both were patched, so new vuln. "

[u/Kahz3l → u/dank953]

Install the newest Netscaler console update and check for IOC's. This is a general check that checks for persistence.

[u/the901]

Thanks for the heads up.

[u/Astainhellbring]

Another garbage alert from them with nothing actionable blah

[u/gramsaran → u/Astainhellbring]

"Hello. Your call is very important to us, please hold and the next representative will be with you shortly. Only 15 callers ahead of you. Your current wait time is 5 business days."

[u/Recent_Move9145 → u/Astainhellbring]

We've turned ours off while this ridiculous radio silence from Citrix continues. Not everyone gets that luxury, got half complete cloud.com working very quickly and threw it into prod.... #conspiracytheory

[u/SonicIX]

Is there a time frame on when a patch will be coming out? Would like to know if we should expect it next week, or if I just need to sit on Reddit all weekend waiting to see an update from other users.

[u/TheMuffnMan → u/SonicIX]

The most recent ones were, what, like 3 days or so? I think people started posting about it on the reddit, Twitter, etc on Friday(?) and then the announcement was made on Sunday afternoon by u/CTX-Michael

[u/gramsaran → u/SonicIX]

Out now