derekpreston81/cve_adc_ioc_2026Citrix NetScaler CVE Preconditions Checker as per CTX696604 | Supported CVE : CVE-2026-8451, CVE-2026-8452, CVE-2026-8655, CVE-2026-10816, CVE-2026-10817, and CVE-2026-13474
Author: Derek
A Python script to inspect NetScaler configuration files (ns.conf) and determine if an appliance meets the preconditions for specific CVEs. The script parses running configuration or saved config files and reports vulnerable configurations with detailed findings.
| CVE | Description | Precondition Checked |
|---|
| CVE-2026-8451 | SAML IdP Profile | add authentication samlIdPProfile .* |
| CVE-2026-8452 | Auth / Gateway Vserver | add authentication vserver .* or add vpn vserver .* |
| CVE-2026-8655 | Oracle/DNS LB + DNS Recursion | Oracle LB, DNS/DOT vservers, SSL+DNSoverHTTPS, DNS recursive resolution |
| CVE-2026-10817 | TCP TimeStamp ENABLED | TCP profiles with -TimeStamp ENABLED, traces profile-to-vserver/service mapping, handles default profile inheritance |
| CVE-2026-13474 | HTTP/2 ENABLED | HTTP profiles with -http2 ENABLED, traces profile-to-vserver mapping, handles default profile inheritance |
nstcp_default_profile, nshttp_default_profile) have vulnerable settings and enumerates all inheriting vservers/services.sshpass, or SSH via paramiko (pure Python).--json flag for CI/CD pipeline integration.--quiet to show only vulnerable CVEs.git clone https://github.com/derekpreston81/CVE_ADC_IOC_2026.git
cd CVE_ADC_IOC_2026
pip install -r requirements.txt
Note: The script works with only the Python standard library for local file mode.
paramikois only required for SSH fetching.
ns.conf filepython netscaler_cve_checker.py /path/to/ns.conf
python netscaler_cve_checker.py --ssh 192.168.1.1 nsroot password
The script will automatically try sshpass first, then fall back to paramiko.
python netscaler_cve_checker.py --ssh-paramiko 192.168.1.1 nsroot password
python netscaler_cve_checker.py --json /path/to/ns.conf
python netscaler_cve_checker.py --quiet /path/to/ns.conf
From the NetScaler CLI (or SSH):
show ns runningconfig > /var/tmp/ns.conf
Then download ns.conf via SCP/SFTP and run the checker locally.
Use the --ssh or --ssh-paramiko flags (see above). The script runs show ns runningconfig on the appliance and parses the output.
================================================================================
NetScaler CVE Preconditions Checker
Version: 1.1
================================================================================
[CVE-2026-8451] SAML IdP Profile Configuration
Status: NOT VULNERABLE (Severity: NONE)
Precondition: add authentication samlIdPProfile .*
✓ No matching preconditions found.
[CVE-2026-8452] Authentication Vserver / Gateway (VPN) Vserver
Status: VULNERABLE (Severity: HIGH)
Preconditions:
- add authentication vserver .* (AAA Vserver)
- add vpn vserver .* (Gateway: VPN, ICA Proxy, CVPN, RDP Proxy)
⚠ Findings:
VPN/Gateway Vservers (2):
> add vpn vserver GW_VPN SSL 10.0.0.10 443 -icaOnly ON
> add vpn vserver RDP_PROXY SSL 10.0.0.11 443
Recommendation: Review AAA and VPN vservers. Apply patches and restrict access.
[CVE-2026-10817] TCP Profiles with TimeStamp ENABLED
Status: VULNERABLE (Severity: CRITICAL)
Precondition: TCP profiles with -TimeStamp ENABLED
⚠ Findings:
TCP Profiles with TimeStamp ENABLED (1):
> Profile: custom_profile
Config: add ns tcpProfile custom_profile -TimeStamp ENABLED
Attached Vservers (1):
- test_server (add lb vserver)
⚠ DEFAULT PROFILE (nstcp_default_profile) has TimeStamp ENABLED!
All vservers/services without explicit TCP profile are impacted.
Default-impacted Vservers (15):
- vs1 (add lb vserver)
- vs2 (add cs vserver)
...
Recommendation: Disable TimeStamp on TCP profiles unless required.
================================================================================
SUMMARY
================================================================================
CVE-2026-8451: SAFE
CVE-2026-8452: VULNERABLE
CVE-2026-8655: SAFE
CVE-2026-10817: VULNERABLE
CVE-2026-13474: SAFE
Total CVEs checked: 5
Vulnerable: 2
Safe: 3
ACTION REQUIRED: Review findings above and apply vendor patches.
================================================================================
sshpass not found errorInstall sshpass on your system, or use --ssh-paramiko instead:
# Ubuntu/Debian
sudo apt-get install sshpass
# RHEL/CentOS/Rocky
sudo yum install sshpass
# macOS
brew install sshpass
paramiko not installedpip install paramiko
Then use --ssh-paramiko for SSH mode.
This script is provided as-is for security assessment and compliance purposes. Use at your own risk. Always validate findings against vendor security advisories before applying changes.
Derek