NetScaler ADC and NetScaler Gateway Multiple Vulnerabilities (CTX696604)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(324949);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/06");

  script_cve_id(
    "CVE-2026-8451",
    "CVE-2026-8452",
    "CVE-2026-8655",
    "CVE-2026-10816",
    "CVE-2026-10817",
    "CVE-2026-13474"
  );
  script_xref(name:"IAVA", value:"2026-A-0647");

  script_name(english:"NetScaler ADC and NetScaler Gateway Multiple Vulnerabilities (CTX696604)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote NetScaler ADC (formerly Citrix ADC) or NetScaler Gateway (formerly Citrix Gateway) device is
version 13.1 prior to 13.1-63.18, 14.1 prior to 14.1-72.61, 13.1-FIPS/NDcPP prior to 13.1-37.272, or 14.1-FIPS
prior to 14.1-72.61. It is, therefore, affected by multiple vulnerabilities:

  - Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if
    NetScaler ADC or NetScaler Gateway is configured as a SAML IDP. (CVE-2026-8451)

  - Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous
    behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN,
    RDP Proxy) or AAA virtual server. (CVE-2026-8452)

  - Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable
    or erroneous behavior and Denial of Service if NetScaler ADC is configured as an LB of type Oracle OR
    NetScaler ADC is configured as a DNS Proxy OR NetScaler ADC is configured as a DNS recursive resolver
    deployment. (CVE-2026-8655)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported
version number.");
  # https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?83a02083");
  script_set_attribute(attribute:"solution", value:
"Upgrade to NetScaler ADC or NetScaler Gateway version 13.1-63.18, 14.1-72.61, 13.1-37.272-FIPS, 13.1-37.272-NDcPP, or 14.1-72.61-FIPS or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:L");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-8655");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/30");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/03");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:citrix:netscaler_gateway");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:citrix:netscaler_application_delivery_controller");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("citrix_netscaler_detect.nbin");
  script_require_keys("Host/NetScaler/Detected");

  exit(0);
}

include('vcf_extras_netscaler.inc');

var app_info = vcf::citrix_netscaler::get_app_info();

var constraints;

if (app_info['fips_status'] == 1)
  constraints = [
    {'fips':TRUE, 'min_version': '13.1', 'fixed_version': '13.1.37.272', 'fixed_display':'13.1-37.272-FIPS'},
    {'fips':TRUE, 'min_version': '14.1', 'fixed_version': '14.1.72.61', 'fixed_display':'14.1-72.61-FIPS'}
  ];
else
  constraints = [
    {'min_version': '13.1', 'fixed_version': '13.1.63.18', 'fixed_display': '13.1-63.18'},
    {'min_version': '14.1', 'fixed_version': '14.1.72.61', 'fixed_display': '14.1-72.61'}
  ];

vcf::citrix_netscaler::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE
);