netscaler-cve-2026-88778-check

An offline checker for CVE-2026-88778, NetScaler predictable TCP initial sequence numbers (ISNs). It triages operator-reported NetScaler build and configuration evidence and writes JSON, CSV or HTML reports. It is a standalone Python 3.10+ script that uses only the standard library.

It never contacts an appliance, runs application code, scans a configuration or tests exploitability. It has no network mode and no exploit payload.

• What the results mean
• Requirements and quick start
• Version rules
• Configuration observations
• Usage
• Reports and output
• Sources and caveats
• Development and release evidence
• Contributing, security and license

What the results mean

The checker follows the reporting conventions of node2shell-check and php2shell-check. It covers this one CVE only. Every input is an unverified operator claim.

• Reported versions are evidence, not verified runtime state.
• potentially_affected is not confirmed exploitability.
• fixed_version_reported is not a patch or safety guarantee.
• unknown is never safe.
• Every result has exploitability: not_tested.

Requirements and quick start

Requires Python 3.10 or later (use python3 if that is how it is installed on your system). There is nothing to install and there are no dependencies.

# One reported build
python netscaler_cve_2026_88778_check.py --version 14.1-73.36 --variant standard

# The synthetic example inventory as an HTML report
python netscaler_cve_2026_88778_check.py --inventory docs/example-inventory.json --format html --output report.html

# A CSV inventory as JSON, exiting 1 on findings
python netscaler_cve_2026_88778_check.py --csv-list inventory.csv --format json --fail-on-finding

Run only against inventories you are authorized to assess. Run --help for all options.

Version rules

Affected means strictly before the fixed build for the same branch and variant. No lower bound or lifecycle conclusion is invented.

Branch and variant	Vendor fixed build
14.1 standard	14.1-73.37
13.1 standard	13.1-64.23
14.1 FIPS	14.1-73.37
13.1 FIPS/NDcPP	13.1-37.279

Other branches and 14.1 NDcPP remain unknown. An unstated 13.1 variant remains unknown where the standard and FIPS/NDcPP comparisons disagree.

Accepted build text. 14.1-73.37, 14.1.73.37 and NS14.1: Build 73.37.nc, optionally marked FIPS/NDcPP before an optional nc marker. Supply only the build text. Malformed, qualified, non-ASCII, conflicting, custom-build and uncovered evidence remains unknown.

Configuration observations

Supply explicit observations as true, false or unknown CLI flags, JSON booleans or null, or documented CSV values. They remain separate from version status and do not prove reachability. No local configuration or process data is collected.

CLI flag	Meaning	Exposure condition expects
--tcp-vserver	At least one virtual server has a TCP-capable type listed in the bulletin	true
--enhanced-isn-enabled	Enhanced ISN generation is enabled	false

Firmware alone is insufficient for this CVE. The vendor also requires explicitly enabling enhanced ISN generation and verifying that it is active. remediation_status keeps a required or unverified configuration change visible even when version_status is fixed_version_reported. Independent review retrieved the linked vendor TCP configuration guidance: enhanced ISN generation is disabled by default and must be explicitly enabled. The checker executes no configuration command.

Usage

Combine any of --version, --inventory and --csv-list. An existing report is refused unless --force is supplied.

Option	Purpose
--version BUILD	Reported NetScaler build; repeatable.
--variant standard|fips|ndcpp	Variant applied to all CLI versions. Unstated ambiguous variants remain unknown.
--build-source SOURCE	Provenance applied to all CLI versions. Only empty, unknown, official and citrix allow a comparison; anything else stays unknown.
--inventory FILE	Strict JSON inventory (object or non-empty array); repeatable.
--csv-list FILE	Strict CSV with a version header; repeatable.
--tcp-vserver, --enhanced-isn-enabled	Observations: true, false or unknown (default unknown).
--format json|csv|html	Report format (default json).
--output FILE	New report file (default stdout). The output directory must already exist.
--force	Explicitly replace an existing report.
--fail-on-finding	Exit 1 on affected firmware or a required enhanced-ISN change.
--tool-version	Print the tool name and version.

Inputs are bounded (up to 100 files and 10,000 observations per run, 4 MiB per file and 512 characters per string) and must be regular files. Output may not resolve or hard-link to any input, even with --force. Field definitions, input schemas, limits and safety rules are in the reference.

Exit codes

Code	Meaning
0	Report written. unknown results do not by themselves change the exit code and are never a clean bill.
1	--fail-on-finding was given and a result has affected firmware or a required enhanced-ISN change.
2	Usage, input or output error. These are operational failures, not assessment results.
130	Interrupted. Completed observations are preserved where possible, with explicit completeness metadata.

See the reference for publication, interruption and stdout semantics, limits and CSV summary rows.

Reports and output

Formats are JSON, formula-safe CSV and self-contained, script-free HTML. The synthetic example input and generated report describe no real systems.