https://bishopfox.com/blog/citrix-adc-gateway-rce-cve-2023-3519 These guys seem to have found the one that only needs AAA/Gateway enabled. I guess the SAML thing is something extra that got patched?