CVE_ADC_IOC_2026

NetScaler CVE Preconditions Checker

Author: Derek

A Python script to inspect NetScaler configuration files (ns.conf) and determine if an appliance meets the preconditions for specific CVEs. The script parses running configuration or saved config files and reports vulnerable configurations with detailed findings.

Supported CVEs

CVE	Description	Precondition Checked
CVE-2026-8451	SAML IdP Profile	`add authentication samlIdPProfile .*`
CVE-2026-8452	Auth / Gateway Vserver	`add authentication vserver .` or `add vpn vserver .`
CVE-2026-8655	Oracle/DNS LB + DNS Recursion	Oracle LB, DNS/DOT vservers, SSL+DNSoverHTTPS, DNS recursive resolution
CVE-2026-10817	TCP TimeStamp ENABLED	TCP profiles with `-TimeStamp ENABLED`, traces profile-to-vserver/service mapping, handles default profile inheritance
CVE-2026-13474	HTTP/2 ENABLED	HTTP profiles with `-http2 ENABLED`, traces profile-to-vserver mapping, handles default profile inheritance

Features

Profile-to-Vserver/Service Mapping: For CVE-2026-10817 and CVE-2026-13474, traces which vservers and services use vulnerable profiles.
Default Profile Handling: Detects when default profiles (nstcp_default_profile, nshttp_default_profile) have vulnerable settings and enumerates all inheriting vservers/services.
Multiple Input Modes: Local file, SSH via sshpass, or SSH via paramiko (pure Python).
JSON Output: --json flag for CI/CD pipeline integration.
Quiet Mode: --quiet to show only vulnerable CVEs.
Colored Output: ANSI color-coded terminal output for easy reading.

Installation

1. Clone or download the script

git clone https://github.com/derekpreston81/CVE_ADC_IOC_2026.git
cd CVE_ADC_IOC_2026

2. Install dependencies (optional, for SSH mode)

pip install -r requirements.txt

Note: The script works with only the Python standard library for local file mode. paramiko is only required for SSH fetching.

Usage

Check a local `ns.conf` file

python netscaler_cve_checker.py /path/to/ns.conf

Check via SSH (auto-detects backend)

python netscaler_cve_checker.py --ssh 192.168.1.1 nsroot password

The script will automatically try sshpass first, then fall back to paramiko.

Force SSH via paramiko

python netscaler_cve_checker.py --ssh-paramiko 192.168.1.1 nsroot password

Output JSON for automation / CI-CD

python netscaler_cve_checker.py --json /path/to/ns.conf

Quiet mode — only show vulnerable CVEs

python netscaler_cve_checker.py --quiet /path/to/ns.conf

Getting the NetScaler Configuration

Option A: Save running config to a file

From the NetScaler CLI (or SSH):

show ns runningconfig > /var/tmp/ns.conf

Then download ns.conf via SCP/SFTP and run the checker locally.

Option B: Fetch directly via SSH

Use the --ssh or --ssh-paramiko flags (see above). The script runs show ns runningconfig on the appliance and parses the output.

Example Output

================================================================================
  NetScaler CVE Preconditions Checker
  Version: 1.1
================================================================================

[CVE-2026-8451] SAML IdP Profile Configuration
  Status: NOT VULNERABLE (Severity: NONE)
  Precondition: add authentication samlIdPProfile .*
  ✓ No matching preconditions found.

[CVE-2026-8452] Authentication Vserver / Gateway (VPN) Vserver
  Status: VULNERABLE (Severity: HIGH)
  Preconditions:
    - add authentication vserver .* (AAA Vserver)
    - add vpn vserver .* (Gateway: VPN, ICA Proxy, CVPN, RDP Proxy)
  ⚠ Findings:
    VPN/Gateway Vservers (2):
      > add vpn vserver GW_VPN SSL 10.0.0.10 443 -icaOnly ON
      > add vpn vserver RDP_PROXY SSL 10.0.0.11 443
  Recommendation: Review AAA and VPN vservers. Apply patches and restrict access.

[CVE-2026-10817] TCP Profiles with TimeStamp ENABLED
  Status: VULNERABLE (Severity: CRITICAL)
  Precondition: TCP profiles with -TimeStamp ENABLED
  ⚠ Findings:
    TCP Profiles with TimeStamp ENABLED (1):
      > Profile: custom_profile
        Config: add ns tcpProfile custom_profile -TimeStamp ENABLED
        Attached Vservers (1):
          - test_server (add lb vserver)
    ⚠ DEFAULT PROFILE (nstcp_default_profile) has TimeStamp ENABLED!
      All vservers/services without explicit TCP profile are impacted.
      Default-impacted Vservers (15):
        - vs1 (add lb vserver)
        - vs2 (add cs vserver)
        ...
  Recommendation: Disable TimeStamp on TCP profiles unless required.

================================================================================
  SUMMARY
================================================================================
  CVE-2026-8451: SAFE
  CVE-2026-8452: VULNERABLE
  CVE-2026-8655: SAFE
  CVE-2026-10817: VULNERABLE
  CVE-2026-13474: SAFE

  Total CVEs checked: 5
  Vulnerable: 2
  Safe: 3

  ACTION REQUIRED: Review findings above and apply vendor patches.
================================================================================

Troubleshooting

`sshpass not found` error

Install sshpass on your system, or use --ssh-paramiko instead:

# Ubuntu/Debian
sudo apt-get install sshpass

# RHEL/CentOS/Rocky
sudo yum install sshpass

# macOS
brew install sshpass

`paramiko` not installed

pip install paramiko

Then use --ssh-paramiko for SSH mode.

Authentication failures

Verify the username/password are correct.
Ensure the NetScaler IP/hostname is reachable.
Check that SSH is enabled on the NetScaler.

License

This script is provided as-is for security assessment and compliance purposes. Use at your own risk. Always validate findings against vendor security advisories before applying changes.

Author

Derek