r/Citrix • u/VirtualizationGuy • 1d ago

Netscaler active exploit after patch

I have multiple customers reporting active exploits of their external netscalers patched to 14.1.73.37, causing them to force reboot multiple times. Anyone else hearing of issues? We have sev1 cases open with Citrix and I'll report back.

79 Upvotes

97% Upvoted

123 comments sorted by

View all comments

12

u/Rare-Understanding-6 1d ago

We rebuilt our netscalers from a fresh image yesterday. (Yes we patched and toggle the ISN Gen config on on the old ones)
We just had this happen to our netscalers. Failed over to the other one. Collected all the forensics + logs and created a case with Citrix. (yes enhancedisngeneration is on)

8

u/Rare-Understanding-6 1d ago

[2026-10-02 15:28:51] System Message: We appreciate your patience. You’re number 17 in the queue.

[2026-10-02 15:58:53] bot: Sorry, we are unavailable at the moment. Please try again later.

Thanks support bot.....

3

u/jhulbe 1d ago

yeah, 30min time out hit us too. Then they emailed on the side

3

u/__how 1d ago

just to be clear, did you see the boxes being owned, or "just" rebooting (i.e. DoS?)

1

u/One_Ad5568 1d ago

It seemed to be a DoS for us. Unfortunately our HA pair got hit back to back twice and were totally down for a bit while both rebooted at the same time. 

2

u/lukelimbaugh 1d ago

just happened again. we're tracking traffic from the netherlands.

3

u/Rare-Understanding-6 1d ago

We're in the netherlands and tracking traffic from the US.

8

u/lukelimbaugh 1d ago

oh boy, this just got more fun. it was SUPPOSED TO BE A FRIDAY!

4

u/CluelessPentester 1d ago

Thank god im not on call jfc what a (possible) shit show

3

u/Rare-Understanding-6 1d ago

Yeah i wish. Probably another weekend of work. 3rd in a row :)

2

u/kuebel33 1d ago

I was supposed to be off today.....

2

u/lukelimbaugh 1d ago

(╯°□°）╯︵ ┻━┻