NetScaler Vulnerability Check.
Attackers are already scanning for unpatched Citrix NetScaler gateways. Check whether yours still runs firmware that predates the CTX697096 fix.
Passive check on gateways you own. We read only public pages, never an exploit.
Why An Unpatched NetScaler Matters.
The Gateway Is The Front Door
A NetScaler ADC or Gateway sits at the edge, reachable by anyone on the internet. An unauthenticated flaw in it is a flaw with no login in the way, which is exactly what mass scanning looks for first.
Already Exploited, With Public Exploit Code
CTX697096 covers zero-days that were already being used in the wild when the fix shipped, and working proof-of-concept exploit code for the remote-code-execution flaw is now public. Mass scanning for exposed gateways is ongoing, so the window to patch is measured in days, not weeks.
A Patch Alone Does Not Undo A Breach
If an appliance was reachable while vulnerable, updating the firmware closes the hole but leaves any planted webshell, stolen session, or harvested secret in place. Assume compromise and rotate.
One Edge Device Maps The Whole Network
A gateway terminates VPN sessions and brokers internal access. Control of it is a foothold with a view of everything behind it, which is why attackers prize it over a single workstation.
How The Check Works.
- 01
Enter The Appliance Address
Type the hostname, IP, or URL of a NetScaler gateway you own. The check reaches it exactly as a browser would.
- 02
Run The Check
We read the appliance's public login portal and firmware resources to date its build, then compare that against the CTX697096 fix release. No exploit is ever sent.
- 03
Read The Verdict
See whether the firmware predates the fix, the build date we read, the CVEs in scope, and a clear next step when action is needed.
FAQ
Common Questions.
It is the Citrix advisory for a set of NetScaler ADC and Gateway flaws that includes two critical, unauthenticated remote-code-execution zero-days (CVE-2026-88771 and CVE-2026-88772). A gateway on a pre-fix build can be taken over without any credentials.
Yes. The critical flaws were exploited as zero-days before the fix was released, and working proof-of-concept exploit code for the remote-code-execution bug is now public. Attackers are actively scanning the internet for exposed gateways, so an unpatched appliance should be treated as an urgent, time-sensitive risk rather than a routine update.
It dates your firmware from the build timestamp carried in the appliance's own public resources, then compares that against the date the CTX697096 fix was released. A build older than the fix is flagged as exposed. It is a passive read, not an exploit attempt.
Yes. The check only requests public pages and static resources, the same bytes any visitor's browser loads. It never sends a crafted or exploit request and never authenticates. Only check appliances you are authorised to test.
It means the firmware we dated is at or after the fix release, so the build is probably fixed. Confirm the exact build number in your NetScaler console to be certain, and remember a patch does not reverse an earlier compromise.
Some appliances hide the resources we date the build from, or sit behind a proxy that strips them. That is an inconclusive result, not a clean bill of health. Check the firmware build in the console and update if it predates 14.1-73.37 or 13.1-64.23.
One Appliance Checked. See Your Whole Edge.
This tool dates a single gateway. The Brandefense platform inventories every internet-facing appliance you run, flags new CVEs as they land, and keeps watch over your external attack surface without a break.
Request A Demo