netscaler-cve-2026-88776-check

CVE-2026-88776: NetScaler Oracle load-balancer memory corruption. A standalone, offline Python checker that compares operator-reported NetScaler build and configuration evidence with the vendor's fixed builds.

It reads only the build strings and observations you supply. It never contacts an appliance, runs application code, sends an exploit payload or tests exploitability.

• Scope
• Requirements
• Quick start
• Reading the results
• Version rules
• Configuration observations
• Inputs and options
• Reports
• Limitations
• Sources and advisory caveats
• Development
• Contributing, security and license

Scope

This repository covers CVE-2026-88776 only, following the reporting conventions of node2shell-check and php2shell-check. It is a triage aid for inventories you are authorized to assess, not a generic product scanner.

• Reported versions are evidence, not verified runtime state.
• potentially_affected is not confirmed exploitability.
• fixed_version_reported is not a patch or safety guarantee.
• unknown is never safe.
• Every result has exploitability: not_tested.

Requirements

• Python 3.10 or later. The checker uses only the standard library, so there is nothing to install.
• No network access is needed or used.

Quick start

Run the checker from a clone of this repository. Use python3 where python is not available.

# One reported build, printed as JSON on stdout
python netscaler_cve_2026_88776_check.py --version 14.1-73.36 --variant standard

# The synthetic example inventory, written as a self-contained HTML report
python netscaler_cve_2026_88776_check.py --inventory docs/example-inventory.json --format html --output report.html

# A CSV inventory, written as JSON, with a failing exit code if firmware is affected
python netscaler_cve_2026_88776_check.py --csv-list inventory.csv --format json --fail-on-finding

--version takes a reported NetScaler build. To print the checker's own version, use --tool-version; --help lists every option. Inputs can be combined in one run. An existing report file is refused unless you pass --force.

Reading the results

Each observation gets a version status, an independent precondition status and a remediation status.

version_status	Meaning
potentially_affected	The reported build is strictly before the vendor's fixed build for its branch and variant.
fixed_version_reported	The reported build is at or above the fixed build. This is an operator claim, not a verified deployed patch.
unknown	The evidence is missing, malformed, conflicting, custom-build, ambiguous or outside the covered branches and variants. This is not a clean result.

version_reason explains each decision. The main reasons for unknown are a missing or malformed version, conflicting versions or variants, an unrecognized variant, an uncovered branch or variant, an ambiguous required variant and non-official build provenance. fixed_version can list alternative thresholds for an ambiguous 13.1 observation.

• precondition_status is conditions_observed, condition_not_observed or unknown. It summarizes only the configuration observations you supplied and never means verified exposure or a clean result.
• remediation_status separates "firmware update required", "version verification required" and "reported version requirement". It is independent of exploitability, which is always not_tested.
• Version, configuration and remediation statuses are kept separate. Observations never change the version status.

Version rules

A build is affected only when it is strictly before the fixed build for the same branch and variant. No lower bound or lifecycle conclusion is invented.

Branch and variant	Vendor fixed build
14.1 standard	14.1-73.37
13.1 standard	13.1-64.23
14.1 FIPS	14.1-73.37
13.1 FIPS/NDcPP	13.1-37.279

• Other branches and 14.1 NDcPP remain unknown.
• An unstated 13.1 variant remains unknown where the standard and FIPS/NDcPP comparisons disagree.
• Accepted build forms are 14.1-73.37, 14.1.73.37 and NS14.1: Build 73.37.nc, optionally marked FIPS or NDcPP before an optional nc marker. Supply only the build text, not a full show version line.
• Malformed, qualified, non-ASCII, conflicting, custom-build and uncovered evidence remains unknown.

Configuration observations

Supply explicit observations as true, false or unknown CLI flags, as JSON booleans or null, or as documented CSV values. They stay separate from the version status and do not prove reachability. No local configuration or process data is collected.

CLI flag	Meaning	Exposure condition expects
--oracle-lb-vserver	An LB virtual server of type Oracle is configured	true

Inputs and options

Option	Purpose
--version BUILD	Reported build. Repeatable.
--variant standard|fips|ndcpp	Variant for all --version builds. An unstated ambiguous variant stays unknown.
--build-source SOURCE	Provenance of the --version builds. Only empty, unknown, official and citrix allow a comparison; anything else stays unknown.
--inventory FILE	Strict JSON inventory. Repeatable.
--csv-list FILE	Strict CSV inventory with a version header. Repeatable.
--oracle-lb-vserver true|false|unknown	Configuration observation (default unknown).
--format json|csv|html	Report format (default json).
--output FILE	Report file (default stdout). The directory must exist.
--force	Explicitly replace an existing report file.
--fail-on-finding	Use exit code 1 when a result is affected. See exit codes.
--tool-version	Print the checker name and version.

Inventories are bounded and strictly validated: