@Marius Sandbu, I added my findings with yours to -> community.citrix.com/techzone-blogs/…/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve-2026-88771-through-cve-2026-88778

Hello, Some Alerts in NetScaler Console could be also false positive For example in the documentation you have this : Binary signing and verification for enhanced system security

Well the security guide from the beginning has been inaccurate which annoys me to the max You still get "please fix these on the main page but they are related to really old CVE´s that has already been fixed in old build long time ago for example these: ..so could Citrix fix these so we can rely on that NSC Sec Advisor?

I suggest you to get the manual script from citrix support it would be more accurate. Concerning your capture, you should consider to implement relay state rules on your SAML configurations (NS configured as SP and/or as IDP) as it's a real security must have.

I think what Patrick meant above is that even that you have the relay rule, the console still picks it up as if it wasn't there.

Not for us, I saw a few instances that my colleagues installed had the same alert, because they forgot the RelayState, when I asked them to add it and scanned again, it's gone.

small sidetrack on this; In one environment we implemented the relay state rule and their contractor authentication got borked and we needed to roll it back... it has something to do with cache definitely, but we weren't able to find out at that time, what's the cause or how could we resolve it from NetScaler side, rather than asking all users to clear their browser cache

100% sure that it had the trailing / in the URL? That's all I can think of that'll break it every time.

sth like that

yup i get that for CVE-2021-22956 (Max client ) its deff configured but security advisors says my instances dont have it

I think that NetScaler Console IOC we see in the blog post is not the menu "File integrity" in NS Console "on prem". For me it's a new menu actually available in NetScaler Console "Cloud" : docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/ioc.html I consider that the "manual script" to check IOC that you can get from citrix support is more useful

@Frederic ATLAN correct, it's identical to NSC-Cloud. For my OnPrem NSC customers, NOW the IoC menu is there, we had to wait a few ours till it got automatically updated. Now we can run it via OnPrem NSC, too.

The IoC had appeared when I opened on-prem NS Console this morning. I ran it and got a "potentially compromised" result for one HA pair. When I open the resulting PDF report file, I only see warnings for "potentially suspicious files" and of those, only a bunch of "file does not exist" messages. Does this indicate compromise or more of a false positive?

@Robert Blissitt if you have requests for the Linux / Debian packets, it’s potentially compromised. Got this info from a Citricite

I see that they are references to log files and the dates are really old - some from 2025.