Citrix NetScaler ADC and Gateway (versions below 14.1-73.46 and 13.1-64.29)
Citrix NetScaler ADC and Gateway are enterprise networking appliances used by organisations to manage, secure, and control application traffic and remote access.
Root Cause
The flaw lives in how the appliance processes SAML authentication requests. Input is not properly validated before being written to memory, so a specially crafted request can overflow the buffer and hand an attacker control over what executes next. Think of it like a form that accepts any length of text and crashes the filing system when you type too much.
Attack Vector
A remote attacker sends a malformed SAML request to an exposed NetScaler endpoint. If the appliance is not patched, that request overflows the memory buffer and can either crash the service or deliver arbitrary code with the privileges of the running process. No authentication is required to trigger it.
Recommended Actions
- Upgrade to NetScaler ADC and Gateway version 14.1-73.46, 13.1-64.29, or the relevant FIPS build immediately.
- If patching cannot happen today, restrict external access to SAML endpoints at the network perimeter.
- Review access logs for unexpected SAML authentication attempts or service restarts.