v17.29 - netscaler-quickcheck 17.29, rules 2026-10-22b Latest

First public release of netscaler-quickcheck: security triage for NetScaler ADC and Gateway, run on the appliance, one verdict (OK, UPDATE, INVESTIGATE, FORENSICS_FIRST).

Script 17.29. Build against CTX697096, CTX697174 and CTX697191 with per-CVE conditions; attack traces from syslog, access, error and auth logs (injection with source and download host, dropper requests, webshell probing, management and SSH access); gateway account attacks (password spraying, brute force, sleepers, hits after a failure series); compromise quick check; block list, whitelist and custom rules that survive updates; anonymized reports and address lists; coverage in the result line.

Rules 2026-10-22b. Every indicator traced to its original publisher. Includes the FIPS rows for CVE-2026-88772 and CVE-2026-88778 and the Zscaler ThreatLabz findings of 2026-10-16 (payload path, download server, Nx_7508 webshell files, 27 source addresses). Changelog with SHA-256 per stand in ns_quickcheck.rules.changelog.md.

Validated on NetScaler 14.1 (73.41, 73.46). 13.1 and FIPS: beta, expect yellow findings in block 5 on the first run. Output language is German; field names and verdicts are language-neutral (docs/report-format.md).

Assets
ns_quickcheck.sh SHA-256 033a3802f0dab55702164580e7175e31e3d1491b5a021ab71210707fd80b40df
ns_quickcheck.rules 0ab860a7ca2269d26148ea29960669eddff20b63e552f1efdd8fddf925dcde48

Install: ns_quickcheck_README.md section 1 (German), workflow for new bulletins: WORKFLOW.md. OK means no known pattern matched, not that the appliance is clean; run the vendor’s IoC scan as a second opinion if the appliance was exposed before the fix.