I just received an email from Citrix's automated systems saying to re-run the IoC check. I updated the IoC from my on-prem NetScaler Console using the little cloud icon and the Update Information button and now everything comes back clean. (It wasn't too terribly scary before, but now it's completely clean.) An update is available for Indication of Compromise (IoC) in the NetScaler Console. Please log in to the NetScaler Console and scan the devices for enhanced detection capabilities.

Whats the Script Version now, Date of today?

same here from NetScaler Cloud Console, 29-Sep-2026

Also got the Mails now 😄

So that I could compare them back-to-back, I ran the scan before updating the IoC logic, used the buttons in my screenshot above (thank you to whomever on this forum pointed that button out), and then re-ran the IoC scan.

I don't see this button on the Console Service, but I do have a banner saying there's a new script.

I didn't have the button either, just a mention of the new script. latest scan now comes back with no compromise detected

Did it reverse a detection?

how about CVE detection?

it previously flagged multiple instances with possible compromise.. now there's zero flagged

Citrix has updated their script from "Sept 27, 2026" to "Sept 29, 2026" and the earlier "potential compromise" is reversed to "no compromise" for my aauth instances.

Man, I can't get that script to update for the life of me

At least you can run it. Tried it on 3 clients and it shows as scheduled in eth scan history and then it just disappears and the instances all just say skipped in the main view. Am I missing something here?

@Aaron O'Reilly NetScaler Console Service? Same here

Yeah, but just saw thread above with others having same issue. Think it's probably same thing that is causing manual CVE scans to never complete which leaves my security advisory dashboard telling me I have the right firmware but still have 5 CVEs.

For those of you with the CVE scans stuck, can you go to Telemetry and see if any of your devices are not reporting to telemetry?

Looks like in 2 of the client instances at least 1 of the HA pair is not providing telemetry and hasn't been for some time.

bingo. I have the same problem and I figure because telemetry isn't working on one NetScaler, that the CVE report isn't finishing.

No banner for On-Prem, but here's how it looks for me. Had to go to IoC scan to see it, but have to go there anyway to rerun a scan.. ¯\_(ツ)_/¯