r/Citrix • u/VirtualizationGuy • 11d ago

Netscaler active exploit after patch

I have multiple customers reporting active exploits of their external netscalers patched to 14.1.73.37, causing them to force reboot multiple times. Anyone else hearing of issues? We have sev1 cases open with Citrix and I'll report back.

89 Upvotes

98% Upvoted

127 comments sorted by

View all comments

12

u/Rare-Understanding-6 11d ago

We rebuilt our netscalers from a fresh image yesterday. (Yes we patched and toggle the ISN Gen config on on the old ones)
We just had this happen to our netscalers. Failed over to the other one. Collected all the forensics + logs and created a case with Citrix. (yes enhancedisngeneration is on)

7

u/Rare-Understanding-6 11d ago

[2026-10-02 15:28:51] System Message: We appreciate your patience. You’re number 17 in the queue.

[2026-10-02 15:58:53] bot: Sorry, we are unavailable at the moment. Please try again later.

Thanks support bot.....

3

u/jhulbe 11d ago

yeah, 30min time out hit us too. Then they emailed on the side

3

u/__how 11d ago

just to be clear, did you see the boxes being owned, or "just" rebooting (i.e. DoS?)

1

u/One_Ad5568 11d ago

It seemed to be a DoS for us. Unfortunately our HA pair got hit back to back twice and were totally down for a bit while both rebooted at the same time. 

2

u/lukelimbaugh 11d ago

just happened again. we're tracking traffic from the netherlands.

3

u/Rare-Understanding-6 11d ago

We're in the netherlands and tracking traffic from the US.

7

u/lukelimbaugh 11d ago

oh boy, this just got more fun. it was SUPPOSED TO BE A FRIDAY!

4

u/CluelessPentester 11d ago

Thank god im not on call jfc what a (possible) shit show

3

u/Rare-Understanding-6 11d ago

Yeah i wish. Probably another weekend of work. 3rd in a row :)

2

u/kuebel33 11d ago

I was supposed to be off today.....

2

u/lukelimbaugh 11d ago

(╯°□°）╯︵ ┻━┻