NetScaler ADC Guides & Security

NetScaler CVE Checklist: Updates, Security Assessment and Incident Response

Critical vulnerabilities in NetScaler ADC and NetScaler Gateway require a structured approach: assess exposure, select a secure target version, update affected systems, and then determine whether there are any indications of compromise.

This checklist summarizes the key steps for dealing with new NetScaler CVEs. The current vendor security bulletin, supported firmware builds, and the specifics of your own environment should always be considered authoritative. Do not assess only the current patch status. CVE-specific prerequisites, the period during which the appliance was publicly exposed, and potential indicators of an earlier compromise must also be taken into account.

Important: The commands listed in this article are intended to identify investigation leads. A match is not automatically an Indicator of Compromise (IOC) and must always be evaluated in the context of the affected CVE, the installed build, and your individual NetScaler configuration.

Assess the CVE and Prepare the Update

When assessing a NetScaler appliance, do not look exclusively at the currently installed firmware version. You also need to determine whether the appliance was publicly accessible during a vulnerable period and whether the configuration prerequisites for the respective vulnerability were present.

CVE-2026-19490 currently requires particular attention. This critical authentication bypass vulnerability (CVSS 9.3) affects, depending on the installed build, NetScaler systems configured with Gateway or AAA virtual servers and, in some cases, additionally requires a configured SAML Action. Exploitation attempts in the wild have since been reported, and a public Proof of Concept is available.

Affected systems must be updated to at least 14.1-73.32, 13.1-63.21, 14.1-FIPS 73.32, or 13.1-FIPS/NDcPP 37.277, respectively. Citrix does not provide a workaround.

In addition to the firmware version, check the relevant prerequisites in ns.conf:

grep -E '^add (vpn|authentication) vserver ' /nsconfig/ns.conf
grep -E '^add authentication samlAction ' /nsconfig/ns.conf

1 2	grep -E '^add (vpn\|authentication) vserver ' /nsconfig/ns.conf grep -E '^add authentication samlAction ' /nsconfig/ns.conf

NetScaler ADC Firmware Upgrade

Regular firmware updates are one of the most important maintenance tasks in a NetScaler ADC infrastructure. In addition to new features, current firmware releases include important bug fixes and security-related patches. Especially in the case of security advisories or actively exploited vulnerabilities, firmware updates should be scheduled promptly.

Because a firmware upgrade can affect production services such as NetScaler Gateway, Load Balancing, Content Switching, AAA, GSLB, or SSL Offloading, it should never be performed without proper preparation. A structured approach reduces downtime and minimizes the risk of unexpected issues.

This article describes the recommended upgrade process for production NetScaler ADC environments.

Checklist for NetScaler (Citrix ADC) CVE-2025-5777 & CVE-2025-6543

On June 17, 2025, Citrix published a security advisory for CVE-2025-5777, followed by CVE-2025-6543 on June 25, 2025. Both are classified as critical and are actively being exploited in the wild.

Current notice: This article covers a specific older NetScaler vulnerability. For a vendor-independent process covering current CVEs, firmware updates and checks for possible compromise, refer to our NetScaler CVE Checklist.

Threat Overview

CVE-2025-5777: Critical vulnerability due to improper input validation → leads to memory overread
CVE-2025-6543: Enables memory overflow, potentially resulting in DoS or arbitrary code execution → Exploits available !

⚠️ Important: Simply applying the firmware update is not enough. You must manually terminate all active ICA and PCoIP sessions after patching to ensure the vulnerability is fully mitigated.

Checklist for NetScaler (Citrix ADC) CVE-2023-4966

Citrix issued an alert (10/10/2023) about a critical vulnerability (CVE-2023-4966) in all NetScaler (Citrix ADC) & Gateway systems. Several working exploits have been published.

Please note that simply updating the systems is not enough. The connection tokens must also be reset.

Important ! There are no patches for NetScaler (Citrix ADC) version 12.1 or older. These systems have reached their EOL and will therefore no longer be equipped with the necessary fix. In this case please update to the latest 13.0, 13.1 or 14.1 version.

The vulnerability allows anonymous remote code execution and thus unauthenticated attackers to take over various machines with root privileges.

SAML Authentication between Citrix & Microsoft with Azure MFA

Update to the latest cloud navigation.

As a result of increasing projects, here is a little how-to with the summary of my previous articles. The main points are:

Azure AD Seamless Single Sign-On (PTA / PHS)
SAML Authentication (Azure AD as IdP & Citrix Gateway as SP)
Citrix Federated Authentication Service (FAS)
Microsoft Azure Multi-Factor-Authentication with Conditional Access

Requirements

Fully working Citrix Virtual Apps and Desktop Environment (StoreFront & DDC Minimum Version 7.9)
NetScaler with successful base configuration & activated Enterprise or Platinum license (Minimum Version 12.1 Build 50+ for native workspace app, for browser Minimum Version 11.1)
Configured Unified Gateway vServer
Internal and external DNS entries for Unified Gateway vServer (e.g. citrix.deyda.net)
Certificates for DNS entries (wildcard certificates are the easiest)
Existing Azure Tenant with Azure-AD base configuration (Domain, AAD Sync) & activated Azure AD Premium license
AD Connect version installed and configured (Minimum Version 1.1.644.0)
Firewall release for *.msappproxy.net on port 443
Domain administrator credentials for the domains that connected to Azure AD via AD Connect
Installed Authenticator App on Test User Mobile Phone