NetScaler checker for CTX697096, CTX697174 and CTX697191

Read-only precondition and exposure checker for the Citrix NetScaler ADC / NetScaler Gateway security bulletin CTX697096, covering CVE-2026-88771 through CVE-2026-88778, and for CTX697174, covering CVE-2026-88779 (the SAML crash attack), and for CTX697191, covering CVE-2026-107406 (SAML, remote code execution).

⚠️ CVE-2026-88771 and CVE-2026-88772 are exploited in the wild and are listed in the CISA KEV catalog. Upgrade now, and assume breach on internet-facing appliances.

🚨 NEW – CVE-2026-107406 (8 October): critical SAML flaw, remote code execution, upgrade AGAIN. CTX697191, CVSS 9.5: a SAML memory overflow leading to remote code execution or denial of service. On the builds already fixed for CTX697096 and CVE-2026-88779 (14.1-73.37 to 73.41, 13.1-64.23 to 64.28, 14.1-FIPS 73.37 to 73.41, 13.1-FIPS/NDcPP 37.279 to 37.282) you are affected when the appliance is a SAML IdP (add authentication samlIdPProfile); on older builds when it is a SAML SP or IdP. Fixed in 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS and 13.1-37.283 FIPS/NDcPP. The bulletin lists no workaround. Secure Private Access hybrid deployments using NetScaler are affected too. Checker v1.16 checks your build and SAML config against these versions.

CVE-2026-88779 (3 October): the SAML attack now has a fix, and SAML appliances must upgrade again. The crafted SAML requests that crash patched NetScalers since 2 October are CVE-2026-88779 (CTX697174, CVSS 8.7, targeted attacks; on CISA's Known Exploited Vulnerabilities list since 4 October, US federal deadline 7 October). You are affected if your config has add authentication samlAction or add authentication samlIdPProfile. Fixed in 14.1-73.41, 13.1-64.28, 14.1-73.41 FIPS and 13.1-37.282 FIPS/NDcPP, so an appliance already upgraded for CTX697096 must be upgraded again. Until then, Citrix offers Global Deny List signatures through NetScaler Console, or a responder policy from Citrix Support. Checker v1.15 checks your build against these versions, shows whether a SAML mitigation policy covers every Gateway/AAA vserver, and reports injection attempts from 2 October until the CVE-2026-88779 fix as "may have run".

A clean run on a fixed lab appliance, shortened ("..."). The commands are under Usage; example output for other results is under Example output.

❤️ New: you can now support this project. The checker is free and stays free – if it saved you time, a voluntary contribution is appreciated.

It answers four questions for each NetScaler:

1. Is this build vulnerable? It checks the build against the fixed versions and flags end-of-life releases.
2. Which CVE preconditions does this configuration meet? The eight CTX697096 preconditions in the default partition and every admin partition, and the SAML preconditions of CVE-2026-88779 and CVE-2026-107406.
3. What could go wrong during the upgrade? It flags known upgrade issues from the Citrix guidance.
4. Was I hacked? On the appliance it also checks every public indicator of compromise for CVE-2026-88771 published so far (by default since v1.15), and tells you whether attack traffic came before or after your fix.

For background, a timeline and step-by-step remediation, see the accompanying blog post: CVE-2026-88771 through CVE-2026-88778 – what you should know and how to fix your NetScaler.

It is a single POSIX shell script with no dependencies. It runs on the appliance itself or against an exported ns.conf on any Linux, macOS or WSL machine.

---

Fix check and IoC sweep

The script does two things, and on the appliance both run by default (since v1.15): the fix check (exposure and fix status: build, CVE preconditions, partitions, upgrade risks; also works on an exported config) and the IoC sweep (compromise, appliance only). --no-ioc runs the fix check only. The IoC sweep checks every public indicator of compromise for CVE-2026-88771 and CVE-2026-88772 published so far, from Mandiant/GTIG, Unit 42, Arctic Wolf, watchTowr, CERT-EU, GreyNoise, Beazley Security, Elastic, PitScaler.com and its sources, and others (see the credits below).

Use it together with the official Citrix IoC scan, not instead of it.

• The official IoCs are only available through NetScaler Console (Security Advisory, then Indicators of Compromise) or from Citrix Support. Run that scan first, before you upgrade or reboot, because some traces may only exist in memory.
• This script only knows the indicators that have been published. A clean result means none of those were found in the files and logs that are still on the box. It does not prove the appliance was never compromised. Check the log-retention lines to see how far back that goes.
• On an HA pair, run it on both nodes. HA file sync copies webshells to the peer.

What the IoC sweep checks (appliance only)

Context: how much is a clean result worth?

• When the fixed build started running. Taken from the kernel that installns copies to /flash (ns-<build>.gz) and the first boot after the install (/var/nsinstall/installns_state_post_reboot). Every attack line is tagged before or after this time, and the output says where the date comes from. On a vulnerable build it shows when the exposure started, or that a newer build is installed but not running yet. Override with --fixdate if needed.
• Last boot. It shows whether in-memory traces can still be found, and warns if a vulnerable box rebooted recently.
• Log retention for ns.log, notice.log and httpaccess-vpn.log. It warns when less than 7 days are kept, because log-based checks can't see further back.