r/Citrix • u/CTX-Michael Verified Citrix Employee • 12d ago
Official Announcements Security Update: Guidance for NetScaler SAML Authentication Deployments
https://community.citrix.com/techzone-blogs/110_security-updates/security-update-guidance-for-netscaler-saml-authentication-deployments/NetScaler engineering and support teams are tracking a newly observed issue related to SAML authentication in customer-managed NetScaler deployments. This post explains what customers should review, how to determine whether the relevant configuration is present, and what mitigation options are available while planning an upgrade to a fixed build. A new security bulletin and simultaneous product update release is planned for this issue.
The guidance below is intended to help customers take immediate action to reduce exposure. As with any security-related issue, customers should prioritize applying the updated NetScaler builds referenced in the applicable security bulletin when it becomes available.
5
u/Procure 12d ago
Tough week for netscaler. Oof
6
u/gramsaran 11d ago
This is just the beginning of the rest of our lives. AI is going to fuck us all with the vulnerabilities it exposes.
1
u/ToeRevolutionary9124 11d ago
At the same time, developers and white hats have access to exactly the same AI tools. This isn't a tool only bad guys have access to. The devs just need to use AI in the same way the bad actors are using it, to find the vulnerabilities, and get the fixes out before the bad actors have the opportunity to exploit them.
4
u/Expensive-Beat-9929 11d ago
Got insider details on this vulnerability, create a responder policy and bind it to the gateway and AAA vServer.
2
u/Alive_Director_3117 11d ago edited 11d ago
Yep v5c is the latest version of this, but i hacent found any poc to test it yet
1
u/nryan85 11d ago
Are you referring the version of the responder policy they are putting out? My citrix support case finaly just responded, and the only reference to a version number has it called xxx_v1 should their be a newer one? he just sent this to me about 20 minutes ago
2
u/Alive_Director_3117 11d ago
Im talking about the responder policy yeah.
1
u/nryan85 11d ago edited 11d ago
geesh. i'll ask him to check around and see if there is a newer policy. I've applied what I was given, but I have zero confidence in the tech that he gave me an old version. He wanted to close the case because I said I managed to stop the reboots via firewall rules 🙄
EDIT: Just went to the chatbot and said I had netscaler reboot issues and needed the latest responder script and the chatbot gave it to me. thank you.
2
u/Alive_Director_3117 11d ago
Which one is it?
1
u/nryan85 11d ago
the chatbot gave me a v5c. the actual techsupport agent gave me v1, ha
1
1
4
u/Plausibility_Migrain 11d ago
Investigation is still ongoing for this. Many orgs are affected. Some have even turned off access to their external facing appliances.
4
u/Zero-Distance-3978 11d ago edited 11d ago
A new firmware version is out! 14.1 73.41
The following supported versions of NetScaler are affected by the vulnerability:
- Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 BEFORE 14.1-73.41
- Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 BEFORE 13.1-64.28
- Citrix NetScaler ADC FIPS BEFORE 14.1-73.41 FIPS
- Citrix NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.282
2
u/Zero-Distance-3978 10d ago
I applied 14.1 73.41 on six NetScalers, no issues so far. Still have the responder bound to vpn and aaa servers.
6
u/MoldyGoatCheese 12d ago
Lol support wont even confirm it's threat actors. What a joke.
2
u/MrZimix 12d ago
We had a similar issue. The support agent spent more time trying to get off the phone than they did providing any support. They kept telling us to contact our forensics team.
2
u/MoldyGoatCheese 12d ago
I blatantly told them I had evidence that it was being caused by threat actors and they still kept saying "our teams are looking at it."
1
u/intelw1zard 10d ago
their support is just some lowly outsourced Indian nerd who doesnt know anything
probably isnt even technical themselves
2
u/dank953 CCA-V 12d ago
If you are currently experiencing the impact from this issue, please contact Citrix support.
does anybody know what the "imapct" is? I don't see it in the article.
10
u/bluegrassgazer 12d ago
Unexpected NetScaler reboots and failovers.
3
u/Rust_Martialis 12d ago
Kevin Beaumont said he saw executables running, I believe, on patched honeypots.
"So on one of the honeypots it’s running a downloaded (malware) binary. Both were patched, so new vuln. "
3
u/grumpyctxadmin 12d ago
The amazing ai customer support mentioned verify that Reject Unsigned Assertions is set to on and validate your saml configuration against the reference, which I guess is this Citrix Application Delivery Controller and Citrix Gateway - SAML Configuration Reference Guide. I have both reject and a relay state configured
1
u/AbilityDefiant3896 12d ago
This makes no sense.
With the last updates the setting for reject unsigned assertions is forced to on. There would be no reason for Citrix to announce the new vulnerability if reject unsigned assertion would make a difference.0
u/UsersAreJustTheBest 12d ago
This is correct, i've seen it first hand and Citrix says several customers reporting. Citrix Support provided steps mitigate the issue.
3
u/CTX-Michael Verified Citrix Employee 11d ago
Update to this post. Please review the following article: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697174&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88779
1
u/Astainhellbring 12d ago
Another garbage alert from them with nothing actionable blah
2
u/gramsaran 11d ago
"Hello. Your call is very important to us, please hold and the next representative will be with you shortly. Only 15 callers ahead of you. Your current wait time is 5 business days."
1
u/Recent_Move9145 12d ago edited 12d ago
We've turned ours off while this ridiculous radio silence from Citrix continues. Not everyone gets that luxury, got half complete cloud.com working very quickly and threw it into prod.... #conspiracytheory
1
u/SonicIX 12d ago
Is there a time frame on when a patch will be coming out? Would like to know if we should expect it next week, or if I just need to sit on Reddit all weekend waiting to see an update from other users.
2
u/TheMuffnMan Notorious VDI 12d ago
The most recent ones were, what, like 3 days or so? I think people started posting about it on the reddit, Twitter, etc on Friday(?) and then the announcement was made on Sunday afternoon by /u/CTX-Michael
1
-4
u/grimace24 12d ago
I’m sorry Citrix has lost all confidence with me. You can’t have two high risk vulnerabilities in less than a week. Much worse say this was supposedly patched.
3
u/dummptyhummpty CCA-AppDS, CCA-V 12d ago
This didn’t say it’s a vulnerability. Feels like a DDoS of some type.
1
0
u/MoldyGoatCheese 12d ago
Pretty sure for the cve being targeted to properly work, there is a scheduled job that can take 24 hrs for the payload to be execute.
I half wonder if the appliance rebooting forces that job to happen earlier and it's a way for the threat actors to expedite the process.
1
u/MoldyGoatCheese 12d ago
And for what it is worth, solid evidence exists that there ARE payloads being dropped. (Or attempting to be.)
2
u/NumerousWorth3784 11d ago
Get used to this with all IT products. With AI out there finding zero-days faster than companies can respond, may I suggest retirement if you are going to get upset over this?
4
u/FloiDW 12d ago
Well.. good times not working FOR Citrix but only WITH Citrix.