I have multiple customers reporting active exploits of their external netscalers patched to 14.1.73.37, causing them to force reboot multiple times. Anyone else hearing of issues? We have sev1 cases open with Citrix and I'll report back.
Further to the post (https://www.reddit.com/r/Citrix/comments/1ww3ess/security\_update\_guidance\_for\_netscaler\_saml/) made on Friday, we've now updated this with a support article.
A vulnerability has been discovered in Citrix NetScaler ADC (formerly Citrix ADC) and Citrix NetScaler Gateway (formerly Citrix Gateway). Refer below for further details.
NetScaler engineering and support teams are tracking a newly observed issue related to SAML authentication in customer-managed NetScaler deployments. This post explains what customers should review, how to determine whether the relevant configuration is present, and what mitigation options are available while planning an upgrade to a fixed build. A new security bulletin and simultaneous product update release is planned for this issue.
The guidance below is intended to help customers take immediate action to reduce exposure. As with any security-related issue, customers should prioritize applying the updated NetScaler builds referenced in the applicable security bulletin when it becomes available.
For real? And you can't click on the CTX69714 link for details either :(
Being already patched for 88771. I took advantage of adversaries exposing their cards and pulled several scipts off attacker server's between Thursday-Friday just to see what a successful exploit would have done. Which resulted in 3 trends I used to build a list of IOCs. That came in handy today. Hope im wrong but highly expect this will turn out to be some successful rce for the ones that hit the mark.
​
Hi everyone,
We have a hybrid Citrix CVAD environment with both on-premises and cloud infrastructure.
We recently upgraded both NetScaler ADCs. After the upgrade, some vulnerabilities were detected, so we shut down one ADC. Currently, only one ADC is operational.
Since then, multiple users have reported an “Identity Provider Access Denied” error while trying to access Citrix. The error occurs after the authentication process, but we haven't confirmed whether it is directly related to the ADC upgrade or shutting down one ADC.
What we have observed:
- Multiple users are experiencing the error when accessing Citrix.
- Our Global Administrator granted additional permissions/access to some affected users, after which they were able to log in successfully.
- However, a few users are still experiencing the same error.
- Several other users can access Citrix without any issues.
We haven't identified the root cause yet and are trying to understand whether this is related to NetScaler, Citrix authentication, or Microsoft Entra ID.
Questions for experienced Citrix/NetScaler admins:
Could shutting down one ADC after the upgrade cause this kind of issue for specific users?
Could this be related to SAML authentication, the identity provider configuration, Entra ID enterprise application permissions, or Conditional Access?
Why would granting additional permissions resolve the issue for some users but not others?
Which logs should we check to identify the exact failure point?
What troubleshooting steps would you recommend for a hybrid CVAD environment?
We want to identify the actual root cause rather than continue granting additional permissions as a workaround.
Has anyone encountered a similar issue after a NetScaler ADC upgrade?
Any suggestions would be appreciated. Thanks in advance!
I have experience in Citrix ADC support but now it feels so bumpy. What could I do in future since it is my first job.
