Reviewed 2026-10-25 against the actual standalone entry points, input schemas and embedded rules. All 17 named edge advisories have CSV ingestion and independent per-device rule evidence; flag names vary below. No combined edge scanner is introduced. The first two NetScaler checkers already carry separately dated CISA-ADP KEV and vendor exploitation metadata. The remaining explicit KEV-field updates are merged in separate Copilot-reviewed PRs. All actual merge-commit CI jobs for those 15 updated checkers passed; delivery receipts record their exact commits.
CISA's official kev-data mirror confirms
catalog 2026.10.23, released 2026-10-23T19:30:18.9209Z. Exact source:
revision b9c486ef8f3ba0709bb662ae843ffee96953c400.
Full catalog SHA-256:
97a6e54bc74c651ab3c55657191db9adec6c63b05ca54e4205327cfd97a8fb70.
The direct CISA feed was unavailable during this review; the official mirror
provides the dated source. No checker fetches it while assessing inventories.
External listing is not local exploitation, and not_listed is not a safety claim.
| Advisory / independent checker | CSV input | Configuration/deployment scope | KEV snapshot / delivery |
|---|---|---|---|
| CVE-2026-88772 | --inventory FILE.csv |
Complete DTLS export, ordered add/set/defaults, per-vserver identity; incomplete/unsupported remains unknown | listed 2026-09-27; existing ADP metadata in report |
| CVE-2026-88771 | --inventory FILE.csv |
No optional feature prerequisite; never gate on DTLS | listed 2026-09-27; existing ADP metadata in report |
| CVE-2026-102258 | --csv-list FILE |
Exact branch/model, authenticated/interface condition and custom-build uncertainty; table gaps unknown | not_listed; PR #10 (merged; merge-commit CI passed) |
| CVE-2026-102257 | --csv-list FILE |
Exact branch/model, authenticated/interface condition and custom-build uncertainty; table gaps unknown | not_listed; PR #11 (merged; merge-commit CI passed) |
| CVE-2026-102256 | --csv-list FILE |
Exact branch/model, authenticated/interface condition and custom-build uncertainty; table gaps unknown | not_listed; PR #11 (merged; merge-commit CI passed) |
| CVE-2026-102764 | --csv-list FILE |
Separate self-hosted patch evidence and provider-managed SaaS uncertainty | listed 2026-10-16; PR #8 (merged; merge-commit CI passed) |
| CVE-2026-88778 | --csv-list FILE |
Advisory-specific typed operator observations; independent variant/build provenance | not_listed; PR #10 (merged; merge-commit CI passed) |
| CVE-2026-88777 | --csv-list FILE |
Advisory-specific typed operator observations; independent variant/build provenance | not_listed; PR #10 (merged; merge-commit CI passed) |
| CVE-2026-88776 | --csv-list FILE |
Advisory-specific typed operator observations; independent variant/build provenance | not_listed; PR #10 (merged; merge-commit CI passed) |
| CVE-2026-88775 | --csv-list FILE |
Advisory-specific typed operator observations; independent variant/build provenance | not_listed; PR #10 (merged; merge-commit CI passed) |
| CVE-2026-88774 | --csv-list FILE |
Advisory-specific typed operator observations; independent variant/build provenance | not_listed; PR #10 (merged; merge-commit CI passed) |
| CVE-2026-88773 | --csv-list FILE |
Advisory-specific typed operator observations; independent variant/build provenance | not_listed; PR #10 (merged; merge-commit CI passed) |
| CVE-2026-19489 | --csv-list FILE |
Advisory-specific typed operator observations; independent variant/build provenance | not_listed; PR #10 (merged; merge-commit CI passed) |
| CVE-2026-102255 | --csv-list FILE |
Exact branch/model, authenticated/interface condition and custom-build uncertainty; table gaps unknown | not_listed; PR #14 (merged; merge-commit CI passed) |
| CVE-2026-19490 | --csv-list FILE |
Gateway/AAA and branch-specific SAML observations; config patterns do not establish absence/reachability | listed 2026-09-09; PR #13 (merged; merge-commit CI passed) |
| CVE-2026-104935 | --csv FILE |
Version-only; backport source confidence and unknown uncovered releases retained | listed 2026-10-13; PR #10 (merged; merge-commit CI passed) |
| CVE-2026-104286 | --list FILE |
IBE/exposure mitigation separate; cloud and disputed 7.0 remain unknown | listed 2026-10-01; PR #12 (merged; merge-commit CI passed) |
Use each tool's documented product/edition/variant fields and synthetic examples;
do not feed a generic CMDB schema blindly into every checker. Existing CSV
adapters validate columns and map explicit per-device facts. Conflicts,
vendor/custom builds, incomplete configurations and uncovered future releases
remain uncertain under each checker's rules. Missing versions normally remain
unknown. One explicit exception is BeyondTrust's operator-declared SaaS deployment
with custom_build=false: its pinned checker can report fixed_version_reported
without a version, using operator_unverified confidence. This is an unverified
provider-managed deployment claim, not patch attestation or a safety guarantee.
Optional network mode is omitted because passive responses cannot establish firmware patch/configuration state; no network mode is needed to satisfy this offline delivery.
No raw configuration parser is invented for version-only advisories. Supported configuration exports are conservative hints: the original DTLS parser's default, explicit OFF, subsequent set, multiple-server and incomplete-export cases already have fixtures. NetScaler 88771 is independent of DTLS. SaaS/vendor-managed evidence is never assumed equivalent to a verified self-hosted patch. All outputs retain local exploitability not_tested.
The linked pinned README revisions describe the audited baseline implementation; new metadata PRs are separately identified and require exact-head hosted checks. The original baseline CI receipts are in CHECKER_STATUS.md.