https://worldofeuc.com logo
Join Slack
Powered by
Looks like a new 'actively exploited' Netscaler CV...
# citrix-netscaler
l
Looks like a new 'actively exploited' Netscaler CVE coming early next week. reddit.com/r/Citrix/…/netscaler_leak
m
l
Ha, glossed right over that post. Thanks!
👍🏻 1
👍🏼 1
d
I hear Tuesday
o
Groundhog Day with this stuff..ugg
r
From Citrix. Thank you for reporting to us your concern involving your Citrix NetScaler instance. Our teams are working around the clock to develop a fix to address the recently identified NetScaler vulnerabilities and expect to have an update to share soon. We don't have any additional details to share at the moment, but if you have a security concern, please notify secure@cloud.com and open a support case.
I opened a sev 1 case and the support person told me the same thing. I said this is the open case.... 🤦‍♂️
😶‍🌫️ 1
s
Saw the post in X. Came here to see if it's legit. Seems it's headed that way
m
I received an email that Adaptive Authentication was upgraded tonight. Normally they notify me that they are doing in a upgrade in the near future. But tonight I only receive an "update complete" email.
r
It is legit. Citrix is very tight lipped, and we should be getting a patch soon. The smoke signals I am seeign say very soon.
d
Looks like adm connectors were automatically updated last night. May or may not be related?
v
we shutdown external access to our org like hours ago. adding firewall exceptions on ad hoc basis. shutdown access to GSLB dns and set ip addresses in DNS control panel instead allowed access internally and via VPN better safe than very-very sorry. re commnnectors interesting. hopefully citrix control plane is not hacked
c
Any new Infos ??
f
There are one or two vulnerabilities that allow for RCE quite easily. If you do not want to—or cannot—take the risk, disable internet access to the appliance. Attacks have been ongoing for days, though I cannot currently quantify how widespread they are. I cannot speak for Citrix, but a new firmware patch will be released very soon. If you have noticed suspicious appliance reboots in recent days, that is a warning sign; check for cold restarts as well. The file system integrity scan feature helps. Check for any changes to the 
httpd.conf
file and modified permissions on 
bin/sh
. The attack can be traced via HTTP access logs—correlating them with the reboot event—or by searching for 
b64decode
strings. Also, check for 
.dot
files created in 
LogonPoint/custom
. I believe a script for checking Indicators of Compromise (IOCs) will be released regardless. Take this information for what it is and make your own decision while waiting for official information from the vendor.
❤️ 2
🙌 1
g
Somebody mentioned on Reddit that there is a patch and it will be announced at 22:00 CET tonight. Hope it’s true already set an alarm.
n
Well, as with all things Citrix, I can't say I trust the rumor mill - I'd certainly enjoy seeing anything from them, but.. I don't expect anything today. Will I still check? Absolutely..
🤣 2
f
There is a firmware that is being released privately; I believe it will be published very soon. But I can't tell you exactly when.
v
early access
ok, something we got. but , please wait for official response for your own cases. we still sent follow up email to confirm there are no actions required in our specific case with our specific firmware versions on specific hypervisor and AG config, SAML etc ===== Thank you for reporting to us your concern involving your Citrix NetScaler instance. Our teams have been working around the clock to develop a fix to address the recently identified NetScaler vulnerabilities. We now have an early access build available for you to review. This early access build of Citrix NetScaler includes updates designed to address the issues you’ve encountered. Please be advised that, as an early access build, this software has not yet completed the final stages of our rigorous testing process and therefore may contain bugs, errors, and other defects. As such, this early access build is provided “AS IS” without Maintenance, warranties, or indemnities. If our final rounds of testing identify any necessary revisions, you may need to install the final GA release when it becomes available to be entitled to the full benefit of the terms and conditions that apply to our GA releases, including applicable representations, warranties, and Maintenance rights. Below is the link for you to deploy this early access build: 14.1 version: URL removed 13.1 version: URL removed Known issue with 13.1-64.23 NSHELP-45626: NetScaler ADC and Gateway configurations with policy expression configured using non-transaction NS variable will be impacted. This issue is specific to the13.1-64.23 build; other NetScaler releases are not impacted. Sample configuration: add ns variable ns_var -type text(100) add ns assignment clear_act -variable $ns_var -clear A fix for this issue is in progress and will be made available as soon as it is ready. As this is CVE issue as of now we will reduce sev of the case to high and we will monitor the case once we have any further details we will get back to you with an update if you have any further questions kindly let us know also help us with support bundle of NetScaler. =====
👍 2
r
If you open a ticket and send an email to secure@cloud.com I believe you will receive the private patch access. Please follow that process to obtain it.
v
arghh, they sent yet another email with a fix but still fail to answer if we affected or not and what’s the status of the fix, also early unsupported access or a proper one. as they previously mentioned only 13.1-64.23 is affected
e
What's the consensus on the early access builds? Any issues after upgrading?
g
No issues in my case. Just the active Gateway sessions dropped, like with prior firmware upgrades.
d
No issues so far. I’ve updated 20 appliances to the 14.1 release, including systems previously running both 14.1 and 13.1.
c
@Deyda early Access Firmware? Do You have a Scanner for Exploit Check?
d
Yes early access firmware. I ‘m on it to build a python script for the internal check
❤️ 5
f
Check httpd.conf and bin/sh for rapid check
a
Not sure it's a good idea to provide links to private fix (in this case) on a semi public forum.
👍 1
l
but still very much appreciated ❤️
n
Opened a support ticket and emailed the secure@cloud.com address above requesting private fix/information, been a couple hours and nothing back yet.
New firmware available on the download site, linked KB article doesn’t work for me
g
Download works for me 13.1 64.24 and 14.1 73.37
n
Same on both, link to KB. Hopefully it’s activated soon - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096
n
I can access 697096 now
n
Yep, got there before me! :)
l
Crazy that 2 became 8
n
NetScaler deployments impacted by CVE-2026-88778 should apply the TCP configuration change as mentioned in https://docs.netscaler.com/en-us/citrix-adc/current-release/system/tcp-configurations.html#enhanced-isn-generation
^^^ kind of buried in the details under the table of CVEs
m
d
does Netcsaler cloud console have latest fix?
m
I believe so
s
I see it in my console
d
image.png
looks like its there
👍 1
m
So for CVE-2026-88778, do we need to apply today's patch AND enable Enhanced ISN Generation, or is enabling Enhanced ISN Generation a mitigation until the patch is applied?
r
Yes, NS console also detects CVE-2026-88778 after updating
👍 1
g
This is then mandatory step? Check: show ns tcpparam | grep "Enhanced ISN Generation" Enhanced ISN Generation: DISABLED Fix: set ns tcpparam -enhancedISNgeneration ENABLED
r
image.png
🤣 2
Just about everything. 😉
g
Yeah, thats why I was asking idd.
r
If you have Netscaler Console configured it also notifies you with this extra step
Mine are all updated 😉
g
Ah doing it manually, ty
r
There are also indicators of compromise on NetScaler Console Service and on-premises. Run those against your appliances and any that indicated compromise will need to be re-deployed. 😞
m
Presumably the IoC "Script Version" reporting Sept 27th, 2026 means that it's been updated for today's announcements/IoCs?
r
Yes.
According to the information in the KB Article, several community notes I have seen, and conversations with NetScaler, the IoCs will show up with the current tool.
m
Great. That's a handy feature.
r
This is a bad one. One of the vulnerabilities is rated at a 9.5 and requires that you have a NetScaler. Regardless of what features you have or do not have enabled....
n
Yeah, that's the one that sent me straight back - I had left ten minutes before.. that was about all the outside I got to see today. :d
j
anyone seeing this after patching?
d
Is this Azure?
I have seen these in Azure Netscalers after patching
@Jason Symczak
j
on prem
m
In my experience, just make sure from the NetScaler Console you can validate it has licensing applied and it's communicating with the NetScaler. I've had this happen before and normally fanangling with the licensing it goes away.
j
wow it wiped out the cert that is bound to our AGVIP
wiped out our SAML server
SAML policy
r
I hope you snapshotted it first @Jason Symczak
And you are using LAS?
j
the LAS issue was our VPX
the other issue is on mpx
r
The IOC check doesn't seem to be visible in my on-prem NetScaler Console (14.1, latest version). The screenshot published at community.citrix.com/techzone-blogs/…/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778#… is a joke. Can anyone confirm where the IOC script version should show up in NS Console? Based on the fuzzy screenshot, I assume it will be a new tab that's not yet visible in my installation.
r
It should look like this
n
Not available for me either, on the required version (14.1 73.36) as mentioned in the post. So, just have to wait until they release it and use the manual checks.. ¯\_(ツ)_/¯
m
Do you have telemetry enabled?
r
Could you share where to find the manual checks?
n
We do have telemetry, yeah. As for the manual checks, it's just what I've used before, so I don't want to lead someone astray.. it's far from perfect, just what I've used over the years. Deyda is working on updating his fantastic notes, but for now, check deyda.net/index.php/…/checklist-for-netscaler-citrix-adc-cve-2025-5777
🙏 1
r
Telemetry enabled here as well, but no IoC tab.
n
And when you can, contact Citrix to see what they say about the IoC in ADM, I'll have to do so tomorrow.. too many failed updates to juggle that chatbot, too.
r
Citrix has said they will provide the scripts if requested. I am guessing a Support Ticket is required.
r
Yes, got them trough support. Cannot share because of tos
e
Any need to upgrade to the new builds if we upgraded to the early access builds earlier? They seem the same to me.
r
If you go to support.citrix.com and ask the chatbot for the offline IOC I am being told it will give the script to you.
r
I've read somewhere that you always need to upgrade to GA to be compliant
h
the enhanced isn generation step is only for 14.1 I presume?
r
Arguing with the Chatbot but it insists on-premises NetScaler Console should have it. For NetScaler Console on-premises, the KB guidance indicates the IoC tab visibility depends on a few prerequisites: • NetScaler Console version 14.1-73.36 or later • Telemetry channel enabled • Prerequisites met and legal terms accepted If it’s still unavailable after that, Citrix Support can assist with IoC scans. 1 Please note: The information given below is an AI generated summary. Please review the full article. Let me know if this article did or did not help. Or if you need me to create a step by step troubleshooting instruction. To narrow this down quickly, can you confirm for the on-prem NetScaler Console: 1. The NetScaler Console server build is 14.1-73.36+ (exact build number)? 2. Where do you enable/verify the telemetry channel in your Console, and is it currently enabled? 3. Do you see any prompt/banner to accept legal terms (and has it been accepted)? If you provide the Console build and whether telemetry/legal terms are enabled/accepted, I can give you a precise set of verification steps. If everything matches and the tab still doesn’t appear, the next step would be creating a technical case so support can validate entitlement/feature availability and provide the offline IoC execution path.
n
I saw some PHP files flagged as “suspicious” in an IOC script output (Citrix provided the script via support ticket request), the same files were flagged for a test VPX pair never exposed to the internet, odd they’d get flagged. SHA256 hash matches across all of them.
n
h
ah the ISN feature is new in 13.1 pre upgrade wasn't there so also needed for 13.1
s
I saw the same PHP warnings. Had a panic attack. Downloaded the build and deployed a new VM and compared the SHA256 hashes. They were identical. Using the AHV Linux Appliances
😑 1
n
Good to know @Steve Elgan am about to do the same just to be doubly extra sure
r
• Customers can also use NetScaler Console File Integrity Monitoring to help detect unauthorized or unexpected changes to monitored files on managed NetScaler instances. This capability supports ongoing integrity checks and can help customers identify file-level changes that may require further investigation as part of their broader security monitoring and incident response process.
k
My experience on File Integrity monitoring is that is (at least close to) useless
💯 1
n
Agreed.. I keep getting false alerts there, too. Just hoping it's fixed for every dang upgrade. :p
💯 1
d
❤️ 3
🙌 1
n
Popped up for me now (the IoC scanner in On-Prem ADM), didn't do anything but wait. https://worldofeuc.slack.com/archives/CKHRXATV2/p1790535802528919?thread_ts=1790428620.499559&cid=CKHRXATV2
✅ 3
r
haha.. funny. Me to
😄 1
l
same here, wasn't there 15 mins ago
r
I'll have to check again for my other customer. Thanks for the information @nsvegman
n
Of course! I have a scheduled scan that seems to be in the way but it popped up on 2/3 ADM's (don't ask.. :P)
s
5 Views
Open in Slack
PreviousNext
Powered by