Last updated:
Many NetScaler administrators are currently likely to be updating their appliances to 14.1-73.33 or later because of current security issues.
And, of course, the recommendation remains:
👉 Install security updates!
However, the release notes contain a small detail worth knowing before the maintenance window.
ICA Proxy sessions may lose their ability to reconnect
The scenario:
A user starts a Citrix session before the NetScaler upgrade.
The session continues running on the VDA.
The NetScaler is then updated to 14.1-73.33+.
When the user subsequently tries to reconnect to the existing session:
💥 Reconnect fails.
The reason is the session tickets issued before the upgrade.
They can no longer be used for reconnection after the upgrade. The user must start a new session.
The good news:
This is not a general ICA Proxy issue after the upgrade.
Sessions started after the upgrade work normally, including subsequent reconnects.
No additional configuration is required.
The affected transition is:
Pre-upgrade session → upgrade → post-upgrade reconnect
Why does this matter?
We normally perform NetScaler HA upgrades with as little user impact as possible:
Upgrade secondary → failover → upgrade primary.
It is easy to assume:
HA upgrade without downtime = users notice nothing.
That is not necessarily true here.
The infrastructure may be fully available while existing ICA sessions are still affected at the next reconnect.
🔥 Zero-downtime HA upgrade ≠ zero user impact
My recommendation
When upgrading to 14.1-73.33+:
👉 Account for existing ICA sessions
👉 Inform users about possible session loss
👉 Prepare the service desk accordingly
👉 Perform the upgrade outside productive usage hours where possible
This small detail can become particularly relevant in 24/7 environments.
Takeaway
Of course, this is no reason to postpone a security update.
But it demonstrates again:
Sometimes the most interesting findings are not in the security bulletin, but somewhere in the release notes. 😉
