Citrix patched the NetScaler SAML zero-day and a new one is being exploited: install the patch today and check how your Mexico operation logs in through Citrix

Last week we wrote about two unpatched Citrix NetScaler zero-days. There is news, and not all of it is good. On October 4 Citrix released the patch for the SAML flaw in NetScaler ADC and Gateway that was already being used in attacks, as BleepingComputer reported.

One day later, on October 5, The Hacker News reported a brand new zero-day, exploited in targeted attacks, that can knock SAML deployments offline. For a foreign company with people in Mexico that means two questions today: has headquarters installed the patch, and what does the Mexico site do if the gateway goes down.

What happened and who it hits

A zero-day is a flaw attackers use before the vendor fixes it. NetScaler is the box, physical or virtual, that people use from outside to reach the VPN, the virtual desktop or the applications of the company.

SAML is the protocol NetScaler uses to ask your identity provider (Entra ID, Okta, ADFS) whether a user is who they claim to be. If the staff at your Monterrey plant see the corporate sign-in page when they connect through Citrix, you almost certainly use SAML.

The typical setup we see: headquarters in the US or Europe runs the NetScaler, and the Mexico operation only logs in through it. Nobody local knows what version it runs. That is fine until a week like this one.

How to tell if your NetScaler uses SAML

In the admin console, look at the authentication policies on the Gateway virtual server. A SAML action, or an advanced authentication (nFactor) flow with a SAML step, puts you on the list.

Quicker hint: ask your IT team whether the VPN username and password screen belongs to Microsoft, Okta or Google rather than Citrix. If it does, SAML is in the middle.

Also write down the exact firmware version. The Citrix bulletin lists which versions are affected and which ones carry the fix. Compare against that list, not against what somebody remembers.

The order of actions today

Step	What to do	Why
1	Install the Citrix patch on ADC and Gateway	Closes the SAML flaw already under exploitation
2	Terminate every active session	Whoever got in stays in, patch or not
3	Rotate certificates, admin passwords and service accounts	They may have been copied before the patch
4	Review access logs from the last few weeks	Logins at odd hours or from countries where you have no staff
5	Look for new accounts and new administrators	The favorite way to leave a door open

Patching without ending sessions is changing the lock and leaving the window open. The same logic applied to remote access tools in general.

The second zero-day, still without a patch

According to The Hacker News, this flaw can knock SAML deployments offline. It does not need to steal anything to hurt you: it is enough that at 8 a.m. nobody at the plant can reach the VPN.

Until Citrix ships the fix, there are three paths:

• Limit who can reach the NetScaler from the internet. If your Mexico staff connect from fixed offices, filter by IP on the firewall.
• Disable SAML temporarily and fall back to LDAP authentication with a second factor. Uncomfortable, but you keep working.
• Segment: let the NetScaler see only the servers it publishes, not the whole network. If it goes down, access goes down, not the company.

Our opinion: if the NetScaler is the only door into your Mexico operation, build the plan B this week, not the day it fails. In Mexico that plan B usually means someone local who can get people working again while headquarters sleeps.

How ProcessBi helps

Under an IT support plan the NetScaler goes into the inventory like any other server: we know what version it runs, we follow the Citrix bulletins and we apply the patch in an agreed window, with a prior backup and a rollback plan.

After the patch we do the part almost nobody does: end sessions, rotate keys and read the logs. We work remotely in English or Spanish, and when the appliance sits in a Mexico data center we can send local hands for the physical part.

Let's talk

What about your Mexico operation?

If you do not know what version your NetScaler runs, or if the integrator who installed it is long gone, that is the first task of the day.

We offer a free assessment: version, patch status, SAML usage and what plan B your Mexico site has if the second flaw arrives before its fix.

Book your free assessment — we reply the same business day.