netscaler-cve-2026-88775-check

Offline triage of operator-reported NetScaler build and configuration evidence for CVE-2026-88775 (Gateway or AAA memory corruption).

A standalone Python 3.10+ checker that uses only the standard library. It reads the build strings and configuration observations you supply, compares them with the vendor's fixed builds, and writes a JSON, CSV or HTML report. It has no network mode: it does not contact an appliance, run application code, send an exploit payload or scan a configuration.

• Scope and limits
• Quick start
• Inputs
• Version rules
• Configuration observations
• Reading the results
• Reports and output
• Exit codes
• Sources and caveats
• Development and verification
• Documentation
• License

Scope and limits

The checker covers one CVE only and follows the reporting conventions of node2shell-check and php2shell-check.

• Reported versions are operator claims, not verified runtime state.
• potentially_affected is not confirmed exploitability.
• fixed_version_reported is not verified patch state or a safety guarantee. It means the reported build is at or above the vendor's fixed build.
• unknown is never safe.
• Every result has exploitability: not_tested.
• Configuration observations are kept separate from version status and do not prove reachability. No local configuration or process data is collected.
• No deployed appliance, real inventory or exploit was tested during development.

Use only inventories you are authorized to assess.

Quick start

Requirements: Python 3.10 or later (use python3 where that is the command name). There is nothing to install and there are no third-party dependencies. --help lists every option.

# One reported build
python netscaler_cve_2026_88775_check.py --version 14.1-73.36 --variant standard

# The synthetic example inventory, as an HTML report
python netscaler_cve_2026_88775_check.py --inventory docs/example-inventory.json --format html --output report.html

# A CSV inventory, as JSON, exiting 1 if any row is potentially affected
python netscaler_cve_2026_88775_check.py --csv-list inventory.csv --format json --fail-on-finding

Report format defaults to JSON and output defaults to stdout. An existing report file is refused unless --force is supplied. The checker exits with status 2 if no --version, --inventory or --csv-list input is given.

Inputs

--version, --inventory and --csv-list can be combined in one run.

Input	Description
--version BUILD	A reported build. Repeatable. --variant standard|fips|ndcpp and --build-source apply to every --version on the command line.
--inventory FILE	UTF-8 JSON object or non-empty array. Requires schema_version: 1 and a string version. Optional: label, variant, build_source, version_candidates (up to 16 strings). Repeatable.
--csv-list FILE	UTF-8 CSV with a required version header. Optional: label, variant, build_source and observation columns. Repeatable.

Only an empty, unknown, official or citrix build source allows a comparison; any other provenance stays unknown. Provenance is an operator claim.

Input is strict. Unknown or duplicate fields, wrong types, malformed JSON or CSV and over-limit input are errors that publish nothing. Limits are 100 input files and 10,000 observations per run, 4 MiB per file and 512 characters per string. Inputs must be regular files; archives and directory trees are never opened. The reference has the full field and parsing rules, including which fields are JSON-only.

docs/example-inventory.json is synthetic and describes no real systems.

Version rules

Affected means strictly before the fixed build for the same branch and variant. No lower bound or lifecycle conclusion is invented.

Branch and variant	Vendor fixed build
14.1 standard	14.1-73.37
13.1 standard	13.1-64.23
14.1 FIPS	14.1-73.37
13.1 FIPS/NDcPP	13.1-37.279

Accepted build forms are 14.1-73.37, 14.1.73.37 and NS14.1: Build 73.37.nc, optionally marked FIPS or NDcPP before an optional nc marker. Supply only the build text, not a full show version line.

The following remain unknown and are never guessed:

• Malformed, qualified, non-ASCII, prerelease, conflicting and custom-build evidence.
• Branches not in the table, and 14.1 NDcPP.
• A 13.1 build with no stated variant, when the standard and FIPS/NDcPP comparisons disagree.

Configuration observations

Observations are true, false or unknown. Supply them as CLI flags, JSON booleans or null, or documented CSV cell values (true, false, unknown or empty). They never change the version status.

CLI observation	Meaning	Exposure condition expects
--gateway-or-aaa-vserver	A Gateway or AAA virtual server is configured	true

Reading the results

Version status, configuration and remediation are reported separately.

Field	Values
version_status	potentially_affected, fixed_version_reported, unknown
precondition_status	conditions_observed, condition_not_observed, unknown
remediation_status	Distinguishes firmware update required, version verification required and reported version requirement.
exploitability	Always not_tested

version_reason explains the branch, build and variant decision. precondition_status summarizes only operator observations and is never a verified exposure or a clean result. Evidence is always an unverified operator claim.

Reports and output

Formats are JSON, formula-safe CSV and self-contained, script-free HTML. Use --format json|csv|html and --output FILE.