CitrixAnalysisCitrix and CISA release urgent NetScaler SAML memory safety updates
What happened.Citrix and CISA published urgent security guidance for NetScaler ADC and Gateway appliances. The alert addresses a critical memory overflow flaw in SAML authentication configurations during ongoing edge appliance attacks.
Why it matters.Internet-facing gateways remain the primary target for attackers seeking network footholds and active directory tokens. Security engineers should check if SAML profiles are active on their NetScaler appliances and install the latest firmware build immediately.
The technical specifications:
- Vulnerability: A buffer overflow lets unauthenticated network attackers trigger remote code execution or force appliance crashes when SAML authentication is active.
- Affected builds: The issue impacts NetScaler ADC and Gateway 14.1 builds before 14.1-73.46 and 13.1 builds before 13.1-64.29.
- Forensics: CISA published detection rules and recommended that administrators collect forensic logs before updating firmware to preserve evidence of prior compromises.