What happened over the last few days can happen again, and probably many times. We need to be better prepared for the next one. During the latest SAML attack (CVE-2026-88779), until the fix shipped, the responder policy was only available by opening a case with Citrix Support. For a vulnerability already exploited as a zero-day, that is a weak approach: attackers already knew the bug, while we were waiting in the support queue. A better option: publish the policy in a KB article visible only after login, for accounts with active maintenance. Include the verification commands (including a check that the Responder feature is enabled) and log access per account. Citrix keeps control over who sees it, and we get the mitigation right away, also without NetScaler Console. What do you think about this? Do you have better ideas?

Make it available in the NS console as they have our licensing detail here like for the IOC script.

I'm a bit on the fence. I can understand you don't want publish the responder policy on a public page. If the mitigation is also known to the hackers, it will be easier for them to work around it. Since it shows exactly what you are filtering. On the other hand, if you need to log a case to get the policy (which takes time for the customer as well as Citrix) it might take too long before you are 'safe' and will also put too much strain on Citrix support. So putting it in a KB article behind a login with active maintenance (as you suggested) would be best. Putting it in NS Console is also an option, but not everyone is using that.

If they included additional global block options, like how they do with iprep for ips owned by public VPN and VPS providers would mitigate a lot of these. All of the clients that had enabled blocking those have seen none of these current attack attempts.

Global Deny List would be the answer, if it would work.

If I recall, they said items dont get added to the Global Deny List until a patch is available. So once the latest firmware came out, then the Global Deny List would block it, but that was like 10PM EST that day when it finally dropped.

That's not what I was expecting from that feature

Same. Not cool that there was no protection on .41 for the SAML CVE before going to .46 either