Citrix Technology Professional (CTP) - Lead IT Consultant @ Deyda Consulting - CCE-V - CCE-N - CCP-M - MCSA - MCSE - Father of 3
Nettetal, Deutschland
Joined July 2009
- Tweets1.9K
- Following422
- Followers1.4K
- Likes1.5K
Pinned Tweet
New NeverRed Version (2.10.24)
-Added Microsoft Teams NEW (Version 2)
-Added function to create a scheduled task for every logon
This is needed to create a empty settings.json file in every local profile. Only with this file in place the Teams AddIn for Microsoft Outlook works
Manuel Winkel retweeted
📝 ACL commands, flowchart and timeline on the blog: poppelgaard.com/cve-2026-887…
🙏 Thanks to @RemkoWeijnen for the firmware analysis, @Deyda84 for the clean references and feiglein74 for four PRs.
Citrix’s latest NetScaler bulletin covers CVE-2026-107406 (Critical, CVSS 9.5): a SAML-related memory overflow with potential RCE or DoS. Check your build and SAML role. Fixed: 14.1-73.46+, 13.1-64.29+.
Checklist: deyda.net/index.php/de/2026/…
Bulletin: support.citrix.com/external/…
Manuel Winkel retweeted
Patched @NetScaler for CTX697096 and use SAML? Patch again.
CVE-2026-88779 is a separate bulletin, CTX697174 (CVSS 8.7), not part of CTX697096. It's the SAML attack crashing patched NetScalers since 2 Oct. @citrix sees targeted attacks.
Affected: "add authentication samlAction" or "samlIdPProfile" in ns.conf
Fixed: 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS, 13.1-37.282
Interim: Global Deny List (NetScaler Console) or Citrix Support's responder policy, -type AAA_REQUEST on every Gateway/AAA vserver
Free checker v1.12 covers both bulletins:
• CVE-2026-88779 on every run
• SAML policy coverage per vserver
• "may have run" window ends at the fix
• 98 IPs, 16 domains, 34 hashes
Thanks to @GothamTG , @BeazleySecurity , @Deyda84 , @citrixguyblog , @rjfaulknerjr @FerroqueSystems, @bishopfox , @watchtowrcyber and the community 🙏
#NetScaler #Citrix #CitrixNetScaler #NetScalerGateway #CVE202688779 #CVE202688771 #CTX697174 #CTX697096 #CyberSecurity #InfoSec #IncidentResponse #ThreatHunting
Manuel Winkel retweeted
🛠️ NetScaler CTX697096 checker v1.9: every public IoC since v1.8 in one read-only command. nsmon Perl implant, Unit 42 .deb webshell, trace-wiping cron jobs, /tmp/watchTowr marker, 42 attacker IPs. Every attack tagged before/after your fix.
⚠️ The CVE-2026-88772 DTLS tool is public. Can't patch today? Block UDP/443 or disable DTLS. And enable Enhanced ISN: patching alone doesn't close CVE-2026-88778.
github.com/ThomasPoppelgaard…
Thanks @emilstahl (PitScaler), @Unit42_Intel , @AWNetworks , @watchtowrcyber , @elastic , @Deyda84 🙏
#NetScaler #CVE202688771 #CVE202688772 #CVE202688773 #CVE202688774 #CVE202688775 #CVE202688776 #CVE202688777 #CVE202688778 #Citrix
🚨 NetScaler: Patching is only half the job.
Recent findings indicate attack activity going back to early Sept.
My IOC script helps identify exploitation traces, suspicious files/webshells and more.
Patch. Verify. Hunt backwards.
q.me-qr.de/hedqqewj
#NetScaler #Citrix
Manuel Winkel retweeted
🚨 NetScaler CTX697096: checker v1.7 is out.
If v1.4–v1.6 told you "all attacks came after the fix", run v1.7 again. On a production box, older versions missed an exploit attempt from 1.5 h BEFORE the patch, hidden in a rotated log. v1.7 checks every line and puts [BEFORE fix] on top.
Attackers now go for config + keys: one payload tar'ed /flash/nsconfig into a fake .html for download. v1.7 flags it, whatever the name.
New: 17 attacker IPs, dropped files, persistence, "ARMED" payloads on unpatched boxes.
Citrix also updated the Console IoC scan on 29 Sep. Re-scan.
Thanks @GothamTG , @Deyda84 & Michael Shuster @FerroqueSystems 🙏
#NetScaler #CTX697096 #Security #IOC
NetScaler: Logs from several appliances show attack attempts consistent with CVE-2026-88771: Base64-encoded commands in the HTTP User-Agent, crafted “pitboss” log entries, and payload download attempts.
deyda.net/index.php/de/2026/…
#NetScaler #Citrix #CyberSecurity
Citrix confirms exploitation of CVE-2026-88771 and CVE-2026-88772. My updated NetScaler checklist covers all eight CVEs and includes a read-only triage script. A clean scan does not prove an appliance is uncompromised.
deyda.net/index.php/de/2026/…
#DeydaConsulting #NetScaler #Citrix
Back in NetScaler Security Research.
I've rebuilt my Security Scanner & over the next weeks I'll be scanning publicly exposed NetScaler instances as part of responsible white-hat research and notifying affected organizations where appropriate.
#NetScaler #Citrix #CyberSecurity
A new day, a new Teams topic
Updated my guide on deploying #NewTeams (2.x) in #Citrix:
bit.ly/4efkSQs
Added:
✔️ Troubleshooting from real projects
✔️ New deployment insights
✔️ SlimCore deep dive
If you don’t understand SlimCore, you’re debugging blind in 2026.
#VDI
🚨 Citrix LAS deadline is coming. FAST.
📅 April 15, 2026
❌ License files stop working
❌ No fallback
If you’re not on LAS yet → act now.
👉 deyda.net/index.php/en/2026/…
#Citrix #VDI #LAS
A new day, a new LAS topic
If you suddenly see multiple catalogs going unregistered after migrating to Citrix License Activation Service and your event logs show:
"NotLicensedForFeature"
Check if Multi-Type Licensing is enabled.
shorturl.at/2Nvs8
If you encounter this error during NS offline activation, use the following commands:
- copy the cloud file to your ns (path /nsconfig/license)
- run the command ns laslicense -filename blobfilename.tgz -filelocation /nsconfig/license -fixedBandwidth
thx @AntonvanPelt
Many @citrix admins see “Blue” after LAS registration and think:
“Done.”
Nope. 😅
Blue ≠ Activated.
A practical guide to migrating CVAD, WEM & NetScaler to LAS before the April 2026 license cutoff 👇
shorturl.at/2Nvs8
#Citrix #LAS
⚠️ January 2026 @Windows updates break Remote Assistance (msra.exe) and @Citrix Director Shadowing with it.
Invites are created, downloaded… and instantly fail.
There’s an unsupported workaround, but it reintroduces the security risk.
bit.ly/4aCToBd
#Windows #Citrix
@Microsoft update KB5062553 for Windows 11 24H2 can break the entire shell experience.
• Missing or crashing taskbar
• Start menu not opening
• Settings app failing to launch
• Black screen due to Immersive Shell not initializing
Full info + script: see KB article…
🚀 Citrix Database Migration made simple!
How to safely move your Site, Logging & Monitoring DBs to SQL 2019/2022 — step-by-step with PowerShell, Always On & best practices.
👉 Read more:
deyda.net/index.php/en/2025/…
#Citrix #CVAD #SQLServer #EUC #DeydaConsulting
Manuel Winkel retweeted
Exciting news! With the #NetScaler VPX 14.1-51.x release, @Nutanix AHV is officially a supported platform for NetScaler. 👏
Learn more. spr.ly/6013APWN7
Manuel Winkel retweeted
#Citrix just introduced a major #NetScaler architectural enhancement: the separation of the management and data planes. This means more secure infrastructure, simplified control, and more. Check it out: spr.ly/6017ATZeH
🚀 Die NRW EUC Community ist live – und wir starten am 18.09. in Köln mit unserem ersten Event!
👉 Praxis, Austausch & Networking statt Buzzwords
👉 Ich selbst spreche über: „99 problems but Authentication ain’t one“
Jetzt Platz sichern: shorturl.at/DUK0V
#EUC #Community