Free NetScaler® build and CVE checker
Paste your NetScaler show ns version output to see which exploited CVEs affect that build, the fixed builds and CISA KEV status. Runs in your browser only.
Your result appears here
Which CVEs apply to the build, the fixed and recommended builds, CISA KEV status and what to run after patching.
How to find your build
The checker needs the release and build number. Either source below gives you both.
On the command line
Sign in to the appliance CLI and run show ns version. Paste the whole output line into the checker, or just the build number.
Example output
NetScaler NS14.1: Build 73.46.nc, Date: Oct 8 2026, 10:12:34 (64-bit)This line reads as release 14.1, build 73.46, which the checker shows as 14.1-73.46.
In the GUI
In the GUI, the release and build appear on the System page. Copy the build number as shown.
FIPS and NDcPP images
FIPS and NDcPP builds have separate fixed builds. 13.1 FIPS uses its own 13.1-37.x numbering, while 14.1 FIPS shares build numbering with 14.1. If your appliance runs a FIPS image, choose FIPS-NDcPP in the checker.
Formats it understands
14.1-73.4614.1-73.46 FIPS13.1-37.283 FIPS/NDcPPNS14.1: Build 73.46.nc14.1 Build 73.46build-14.1-73.46_nc_64.tgz13.1.37.283
What it does not do
Free, browser-only checker: paste the output of the show ns version command from NetScaler ADC or NetScaler Gateway to see which published CVEs affect that build, the fixed builds and CISA KEV status. It is deliberately narrow.
Runs only in your browser. It never scans or connects to any appliance, never asks for a hostname or IP, and nothing you type is sent anywhere.
- No scanning. It does not scan, probe or connect to any appliance. It only reads the text you enter.
- No configuration analysis beyond the boxes you tick and the follow-up questions you answer. Anything you leave blank counts as unknown.
- Mitigations are not detected. Interim measures such as Global Deny List signatures or DTLS turned off do not change the result. Upgrade anyway.
- It cannot tell whether an appliance is already compromised. Patching does not remove an existing compromise. Run the IoC checks from our post-patch checklist.
- FIPS and NDcPP builds have separate fixed versions. Choose the right image type, or the fixed build shown will be for the wrong train.
- Coverage is limited to the advisory data. NetScaler ADC and NetScaler Gateway security bulletins from May 2023 (CTX477714) to 8 Oct 2026 (CTX697191). Older KEV entries affect only end-of-life releases. NetScaler Console/SDX SVM bulletins are out of scope.
Last verified 2026-10-15 against CISA KEV and CVE.org.
CISA KEV catalog version 2026.10.15 (catalog page). Data as of 2026-10-15 (matrix 2026.10.15-1), built from the vendor security bulletins.
Next steps
Found an affected build? Upgrade every node, then clean up after the patch.
- Upgrade an HA pair safelySecondary first, then fail over, then the other node, with checks between each step.
- Post-patch checklist: session kills and IoC checksWhich sessions to kill once every node is upgraded, and how to look for signs of compromise.
- Nightpatch: approval-gated upgradesHA-aware upgrades that run only after a named admin approves the plan, with post-checks and rollback.
- Book a read-only assessmentA fixed-price review of your gateway estate with an expert-reviewed report. Nothing is changed.
- NetScaler CVE trackerEvery known-exploited NetScaler CVE with fixed builds, CISA KEV dates and post-patch steps.
- NetScaler end-of-life datesEnd of maintenance and end of life for each release, and when to plan the move.
Questions
Does this checker connect to my NetScaler?
No. The check runs entirely in your browser against advisory data that ships with the page. It never scans or connects to any appliance, never asks for a hostname or IP address, and nothing you type is sent anywhere. The build you check is only written to the page address after the # sign, which browsers do not send to servers, so you can share the result.
Where does the data come from?
From the vendor security bulletins for NetScaler ADC and NetScaler Gateway, the CISA Known Exploited Vulnerabilities catalog (version 2026.10.15) and CVE.org records. The data is as of 2026-10-15 (matrix 2026.10.15-1) and covers NetScaler ADC and NetScaler Gateway security bulletins from May 2023 (CTX477714) to 8 Oct 2026 (CTX697191). Always confirm against the vendor bulletin before you change anything.
My build is not affected by any CVE. Do I still need to upgrade?
Usually, yes. A result of "behind safe build" means no listed CVE applies to the configuration you described, but your build is below the recommended build for its release. The recommended build is pinned so that it includes every fix for that release. A feature you did not tick, or a configuration change later, can expose the older build. If the result says up to date, you are at or above that build.
What does "potentially affected" mean?
Your build is in the vulnerable range for at least one CVE, but whether it is exposed depends on features you did not specify, such as a Gateway or AAA virtual server or a SAML configuration. Answer the follow-up questions under the result and the check re-runs instantly. If you are not sure, treat the CVE as affecting you and plan the upgrade.
Does upgrading remove a compromise?
No. Upgrading closes the vulnerability but does not remove anything an attacker already left on the appliance. When CISA flags a CVE for forensic triage (BOD 26-04), preserve evidence such as a snapshot and logs before you patch. Then run the published IoC checks, and kill active sessions only after every node of the HA pair or cluster is on the fixed build.
Need the upgrade done tonight?
Nightpatch runs approval-gated, HA-aware upgrades: the secondary first, then failover and the primary, with post-checks and a rollback path.