Since September 27, Citrix has released three security bulletins for NetScaler ADC and Gateway; two of them address actively exploited vulnerabilities. Since then, anyone running an appliance has been asking themselves the same question every morning: Has anything happened to us?
Our solution is a shell script that runs on the appliance, doesn't change anything, and tells you what to do in just a few seconds. It was developed by Jens Miltenberger based on his practical experience with NetScaler environments. Available on GitHub starting today, under the Apache 2.0 license.
- Build against all three bulletins, with the conditions specified for each CVE (SAML, DTLS, tcpParam)
- Evidence of attacks from syslog, access, error, and auth logs, including the source, network, and a specific "action to take" listed under each finding
- Account attacks: password spraying, brute-force attacks on individual accounts, low-and-slow attempts. Red represents exactly one such case: a successful login following a series of failed attempts.
- PHP outside the management interface is red, no matter what it's called. This also includes webshells that no one has published yet.
- The blocklist, allowlist, and custom indicators remain with the operator. The next run checks whether the block is enforced by the firewall
The rule file lists the source, date, and reference from the original publisher for each indicator. The version dated 2026-10-22b contains the findings from Zscaler ThreatLabz dated October 16: payload path, download server, the Nx_7508 webshells in six directories, and the source addresses of the exploit wave. When the next bulletin is released, the rule file will change, but not the script.
Let's be clear about one thing: "OK" means "no known pattern matched," not "clean." This tool does not replace the vendor's IoC scanner.
Have you seen any patterns that are still missing? Send them to us via an issue or email.