Great post and IOC tool 👏👏poppelgaard.com/cve-2026-88771-through-cve-2026-88778-what-you-should-know-and-how-to-fix-your-netscaler-adc-netscaler-gateway

Updated version of his script this AM.

The script is really nice. But be careful with the [BEFORE fix] [AFTER fix] tags, that it outputs. I found out that it compares the log entry time stamp with the latest time stamp of any file in the /var/nsinstall folder. The problem: in said folder lives a file called adc.version that updates itself, when you log on to the netscaler gui after an update. So even though we were patched on sunday, it flagged everything as [BEFORE fix], because only today we logged into the netscaler GUI and therefor the script thinks thats when we did the netscaler update.

Did you let Thomas know? Is the same experience there in the latest version? I will reach out to him and ask. Thanks fo rhte information!

No, I did not tell him. Yes, new version also has this problem. Just tested with the latest version. Don't have access to my github Acc atm 🫠

Thanks, that's a great catch and you're right. The checker takes the newest entry in /var/nsinstall as the fix date, and adc.version gets rewritten on GUI logon, so everything between the real upgrade and that logon is tagged [BEFORE fix]. That's a false alarm, not a missed attack. I'm fixing it in the next release: it will only look at build folders, prefer the one matching the running build, never use a date after the last boot, show which entry it used, and get a --fixdate option to set the date by hand. Until then: check the "Fixed build installed …" line at the top of the IoC sweep. If that date is wrong, the before/after tags are too.