anyone install the new CVE update yet? issues?

Yes I did for 13.1, all good so far

There's a thread above with information... With 13.1 the biggest catches; Default CSP header gets enabled, SAC client drops to version 25.2.1.18 and if you have WAF enabled for AAA/GW, you might need to update the signatures to v154.

aren't the WAF signatures specific to AAA/GW inside the firmware itself?

To be honest; no clue. We got a couple of GW WAF-enabled environments running signature versions 145 / 152 recovered just by upgrading to 154.

Very weird, maybe because you have a default WAF profile or something enabled on them? I don't even have the WAF feature enabled on my GW's that are WAF protected (silly as it sounds). Because when it came out it specified somewhere in the documentation that it worked differently and separately from the actual WAF feature. Have to go find those docs I guess.

Anyone has a clue if the AAA/GW WAF default setting also changed silently to enabled?

We loaded 13.1-59.19 and 2 hours later FAS decided to break. The CA wouldn't issue any certificates. We proactively rolled back ( we did also see a very weird issue with one gateway vserver where the page wasnt loading correctly which is what drove the rollback) and after rollback FAS was still hosed until we restarted the services. I've not seen that issue before and suspect it wasn't related, unless some weird corruption in the netscaler caused FAS to go nuts. Currently 5 other pairs running 59.19 with no issue though.