Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.

#!/bin/sh
# CVE-2026-88772 Vulnerability Checker for Citrix NetScaler ADC/Gateway
# Checks build version and DTLS configuration status
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

RESULT="UNKNOWN"
DTLS_STATUS="unknown"

# Verify we are on a NetScaler appliance
if [ ! -f /nsconfig/ns.conf ]; then
  echo "[!] /nsconfig/ns.conf not found — not a NetScaler appliance"
  echo "UNKNOWN"
  exit 2
fi

# Extract build version
BUILD=""
if [ -f /var/nsinstall/.build ]; then
  BUILD=$(cat /var/nsinstall/.build 2>/dev/null)
elif command -v cli_script.sh >/dev/null 2>&1; then
  BUILD=$(cli_script.sh 'show ns version' 2>/dev/null | grep -oE '[0-9]+\.[0-9]+-[0-9]+\.[0-9]+')
fi

if [ -z "$BUILD" ]; then
  echo "[!] Could not determine NetScaler build version"
  echo "UNKNOWN"
  exit 2
fi

echo "[*] NetScaler build detected: $BUILD"

# Parse version components: e.g., 14.1-73.37 -> MAJOR=14.1, BNUM=73.37
MAJOR=$(echo "$BUILD" | sed 's/-.*//')
BNUM=$(echo "$BUILD" | sed 's/.*-//')
BNUM_INT=$(echo "$BNUM" | sed 's/\.//' )

# Check DTLS status in running config
if grep -qiE 'add vpn vserver' /nsconfig/ns.conf 2>/dev/null; then
  if grep -qiE 'set ssl vserver.*-dtls (NO|OFF)' /nsconfig/ns.conf 2>/dev/null; then
    DTLS_STATUS="disabled"
    echo "[*] DTLS: Explicitly DISABLED in config"
  else
    DTLS_STATUS="enabled"
    echo "[!] DTLS: ENABLED (default on VPN vServer — CVE-2026-88772 attack surface active)"
  fi
else
  DTLS_STATUS="no_vpn"
  echo "[*] DTLS: No VPN vServer configured (ADC-only deployment)"
fi

# Determine patch status
# Fixed: 14.1-73.37+, 13.1-64.23+
PATCHED="no"
case "$MAJOR" in
  14.1)
    # Compare 73.37 -> 7337
    FIX_INT=7337
    if [ "$BNUM_INT" -ge "$FIX_INT" ] 2>/dev/null; then
      PATCHED="yes"
    fi
    ;;
  13.1)
    # Compare 64.23 -> 6423
    FIX_INT=6423
    if [ "$BNUM_INT" -ge "$FIX_INT" ] 2>/dev/null; then
      PATCHED="yes"
    fi
    ;;
  *)
    echo "[!] Unrecognized major version $MAJOR — may be EOL or newer branch"
    echo "UNKNOWN"
    exit 2
    ;;
esac

# Also check for IOC indicators
echo ""
echo "[*] Quick IOC check:"
IOC_FOUND=0
if [ -f /bin/sh ] && ls -l /bin/sh | grep -q '^-rws'; then
  echo "  [!!] SUID bit SET on /bin/sh — possible compromise indicator!"
  IOC_FOUND=1
fi
if [ -f /tmp/.uxdport ] || [ -f /tmp/.uxdlock ]; then
  echo "  [!!] SLAPSHOT artifacts found in /tmp — possible compromise indicator!"
  IOC_FOUND=1
fi
if grep -qiE 'AddHandler.*application/x-httpd-php.*(deb|sig)' /etc/httpd.conf 2>/dev/null; then
  echo "  [!!] Suspicious PHP handler in httpd.conf — possible WHIPSHOT persistence!"
  IOC_FOUND=1
fi
if [ $IOC_FOUND -eq 0 ]; then
  echo "  [OK] No obvious IOCs detected (run full Mandiant hunt queries for thorough check)"
fi

# Final verdict
echo ""
if [ "$PATCHED" = "yes" ]; then
  RESULT="PATCHED"
  echo "PATCHED — Build $BUILD is at or above the fixed version"
  exit 0
else
  if [ "$DTLS_STATUS" = "enabled" ]; then
    RESULT="VULNERABLE"
    echo "VULNERABLE — Build $BUILD with DTLS enabled (CVE-2026-88772 exploitable)"
    exit 1
  elif [ "$DTLS_STATUS" = "disabled" ]; then
    RESULT="VULNERABLE"
    echo "VULNERABLE — Build $BUILD is unpatched but DTLS is disabled (reduced risk, still patch)"
    exit 1
  else
    RESULT="VULNERABLE"
    echo "VULNERABLE — Build $BUILD is unpatched (no VPN vServer — reduced exposure, still patch)"
    exit 1
  fi
fi