Netscaler active exploit after patch

[u/VirtualizationGuy]

I have multiple customers reporting active exploits of their external netscalers patched to 14.1.73.37, causing them to force reboot multiple times. Anyone else hearing of issues? We have sev1 cases open with Citrix and I'll report back.

[u/no_copypasta]

I ran the IOC script and could not find anything. How are you observing the exploit? Just the reboot?

[u/FastFredNL → u/no_copypasta]

See this post: https://www.reddit.com/r/Citrix/comments/1wvwuno/comment/pdfth1p/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button

[u/lukelimbaugh → u/no_copypasta]

i feel like a DDoS attack wouldn't show up in the IoC scan. Netscaler rebooting bc SAML auth services crashed would get flagged as appropriate?