Citrix’s Patch Predicament: Fixing Vulnerabilities Breaks Logins!
Citrix warns that patching new vulnerabilities on NetScaler appliances could result in broken login pages. The culprit? A Content Security Policy (CSP) header now enabled by default. While designed to block unauthorized scripts, it might inadvertently restrict legitimate ones, complicating life for admins. Proceed with caution, and maybe a prayer.
Hot Take:
***Citrix has found itself in a bit of a pickle. In an attempt to patch vulnerabilities, they’ve inadvertently turned their login pages into a game of “Will It Work?” Pro tip: Don’t play this game with your admin credentials.***
Key Points:
– Citrix’s recent patches aim to fix vulnerabilities but may break login pages on NetScaler ADC and Gateway appliances.
– The default enabling of the Content Security Policy (CSP) header is causing legitimate scripts to be blocked.
– This issue primarily affects setups using DUO configurations, SAML, or custom Identity Providers (IDP).
– Two critical vulnerabilities have been identified: CVE-2025-5777 (Citrix Bleed 2) and CVE-2025-6543.
– Citrix recommends disabling the CSP header temporarily and clearing the cache as a workaround.