@blamejs/exceptd-skills 0.21.14 → 0.21.16

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.21.16 — 2026-09-29
+
+The skill catalog-facts predeploy gate now also compares three more skill table columns with the catalog. The Active Exploitation column is compared with `active_exploitation`. A Patch column is compared with `patch_available`; its header is Patch, or Patch followed by "/" and Mitigation, Remediation or Workaround, each word singular or plural and the header optionally followed by Available or Availability. A Live Patch column is compared with `live_patch_available`; its header is Live Patch written with a space or a hyphen, optionally ending in -able or -es, and optionally followed by Available or Availability. A bare "Livepatch" header is not compared. Other patch and exploitation headers ("Patch Reboot Required?", "Patch Applied?", "Active Exploitation Actor") are not compared. Each cell is compared only in a small set of unambiguous wordings, and any other wording is not compared. An exploitation cell is compared when the whole cell is a state such as "Confirmed", "Suspected", "Unknown", "Theoretical only", "Confirmed mass exploitation" or "Confirmed exploitation 2024"; a plain none wording such as "None", "None observed" or "No exploitation observed in the wild", which agrees with a none or theoretical entry, as a Theoretical cell agrees with a none entry; or a plain denial of confirmation such as "No confirmed exploitation" or "None known", which differs only from a confirmed entry. "Confirmed PoC", "Suspected (supply-chain)" and "No confirmed mass exploitation" are not compared. A patch cell reads as a patch when the whole cell is a vendor patch, update or fix statement such as "Vendor patch", "Vendor fix released", "Vendor patch + config hardening" or "Mitigation + vendor patch", or a Yes followed by one ("Yes, vendor patch"). A bare Yes reads as a patch in a Patch column only; under a Patch / Mitigation, Remediation or Workaround header it is not compared. A Yes with any other text after it ("Yes (workaround)", "Yes, if on 2.x") is not compared. A patch cell reads as no patch when the whole cell is a denial such as "Vendor patch pending", "Vendor update not yet available", "No", "No vendor patch (EoL)" or "Mitigation only; no vendor patch". A Live Patch cell is compared when it opens with a Yes or No that ends the cell or is followed by a comma, semicolon, period, colon, dash or parenthesis ("Yes (kpatch/livepatch)"), and no qualifying word or second answer follows; "No-reboot hotpatch", "Yes (kpatch pending)" and "No (Ubuntu); Yes (RHEL kpatch)" are not compared. These three columns are compared only on a row that names a single CVE, under an identifier header or, in a table with no identifier header, in the first column, and only when no other row in the same section has that CVE as its own row CVE. A section runs from one "#" or "##" heading to the next, so "###" and deeper sub-headings ("### RHEL 9") stay in their parent section. A row's own CVE is the one its first CVE-bearing cell names alone, not counting a row whose CVE cell only points to one ("No vendor CVE; see CVE-..."); a row that names no CVE and leaves blank the cell under the row above's CVE continues that row. An identifier header is CVE or CVEs, optionally preceded by Evidence and followed by ID or Class, alone or as one "/" part of the header ("Class / CVE"), with a parenthetical note ignored ("CVE (if any)"). A header that holds a related, sibling, similar, see also, example, e.g., analog, analogue, PoC, demo, exploit, note, comment, rationale, reason, description or detail word (singular or plural), in its note or in any "/" part ("CVE (example)", "PoC / CVE"), is not an identifier header, and a first column under such a header, or under any other header that names a CVE ("CVE Number", "Paired CVE"), does not name the row. When a later cell of the row cites another CVE ("Chained with CVE-..."), when the row's only CVE is a case cited in such a column, or when the section has that CVE as the row CVE of several rows (one row, one table or one sub-heading per distribution or product line), the row's CVSS, RWEP, KEV, public-exploit and AI cells are compared and its exploitation, patch and live-patch cells are not.
+
+## 0.21.15 — 2026-09-28
+
+The catalog adds CVE-2026-88772, a DTLS memory overflow in Citrix NetScaler ADC and NetScaler Gateway that can lead to remote code execution or denial of service. CISA added it to KEV on 2026-09-27 with a 2026-09-30 due date and requires forensic triage; Citrix bulletin CTX697096 reports exploitation in the wild. The fixed builds are 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS and 13.1.37.279, and the upgrade reboots the appliance. The entry puts the Citrix indicator scan and the CTX694799 evidence collection before any upgrade or reboot. It records an appliance with `-dtls OFF` on every SSL VPN virtual server and no virtual server of type DTLS as mitigated with residual risk for this CVE, and states that the setting does not make it safe to defer the upgrade, because the same builds are also affected by CVE-2026-88771, whose KEV facts the entry gives. It scores RWEP 51. The catalog holds 1,759 CVEs.
+
 ## 0.21.14 — 2026-09-28
 
 14 skills stated CVSS, RWEP, KEV, public-exploit or AI-discovery values for catalog CVEs that disagreed with the catalog, and now match it. The cloud-IAM incident skill listed runc CVE-2024-21626 and the xz backdoor CVE-2024-3094 as KEV-listed with RWEP 88 and 70; CISA has listed neither, and the catalog scores them 35 and 45. The Dirty Frag and Fragnesia CVEs (CVE-2026-43284, CVE-2026-43500, CVE-2026-46300) now read as AI-assisted discoveries with RWEP 53, 47 and 35, where several skills said they were human-discovered and scored 38, 32 and 20; a KEV listing would take Fragnesia to 60, and confirmed exploitation to 80. The security maturity tiers now place the Dirty Frag pair in the Practical tier, which covers RWEP 30 and above. The Windsurf MCP entry (CVE-2026-30615) reads CVSS 8.0 throughout, and CVE-2026-45321 reads as KEV-listed on 2026-05-27 rather than pending. The exploit-scoring factor breakdown for the Windsurf MCP entry gave its public exploit 10 points and its blast radius 20, so its rows summed to 15 against a stated RWEP of 35; they now read 20 and 30.

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-09-29T05:15:50.959Z",
+  "generated_at": "2026-09-30T10:32:27.761Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "de9184697ed6593cde0bb16f3be6a99297e3cbd2fdc1e4a4eaaa94cdfb75ff74",
+    "manifest.json": "f0287eb67bdf0b76c3ea72327ff5a9e117a191248aebaa7f2c41c3849ab10a14",
     "README.md": "864570c1f7fb221b0176d22d3b0823a8d077d6a7209edc6045b426b1e9ec555d",
     "data/atlas-ttps.json": "c36c0a27c8de8a37a7070923d7b187345c46db9db778f58e4637f1f81ca6d6b1",
-    "data/attack-techniques.json": "9857a11bd035c8638e61b200cdabea0cc43f0115b239e4941a19682076a1cfd3",
-    "data/cve-catalog.json": "1b066a7f2b9ae3d7a30870d043f718e6f8f39efbd3c72c834a88d1a8f34b4fde",
-    "data/cwe-catalog.json": "2116d47911a3e50b46495b51a31b12d0aede23233a62ef1362cb72810680b57c",
+    "data/attack-techniques.json": "b2acec4cc79b03c77a36b29ece0b8c26304db51ac6ab6a1c26c9b8a3c481dcb9",
+    "data/cve-catalog.json": "e31a183cc27d3aff6e747e55d0582f0f70e747300e37e50f26f3934ad8e6e08e",
+    "data/cwe-catalog.json": "7fcec8d6afc1ac017ff1a32ddd1404d5dd7cd270c369509416c1b41f40b8950f",
     "data/d3fend-catalog.json": "feec37e4b0a40cd7bc14616b50e7b9bcdb58a92d8e9326f9e2e632896d8ea576",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
     "data/exploit-availability.json": "37300ecbfcb00a4a31423d280247a89a851b1145b5c4200a5513429bfd07dd9b",
-    "data/framework-control-gaps.json": "79e40362b0a71582a88dd2f4af70715218cef45fb9d3e1c00955bda642dda089",
+    "data/framework-control-gaps.json": "ff0103460dc5bd9968e17a9c6d692e0624aecc8d18387f83fcf88646f4ba64d4",
     "data/global-frameworks.json": "86249047c50d2584b4854eb381ba53c309c0e6e29d4cb0e522b4ba1405481de6",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "2862a4be526374cca633cc47f034b70e1988bb28ebaa22314174b9b3a36a27b2",
+    "data/zeroday-lessons.json": "93ad33e59896b2a6c6d4ad3bb6d88f132be27affe78dabdab44e163ae742f89b",
     "skills/kernel-lpe-triage/skill.md": "8cbc65dab6b50b01bdddb8f042f360ebf3bb4f2d38ee7f4d4e9c080d179ca95b",
     "skills/ai-attack-surface/skill.md": "8419f1792c9fe66666afd364d8e593cb3a48096e12563efba109e8a94a8fcada",
     "skills/mcp-agent-trust/skill.md": "c20bda4c1267b16db4f713667216d93e0ab4b98c0fb244024749dcfb32d709cf",
@@ -101,7 +101,7 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 1745,
+    "chains_cve_entries": 1746,
     "chains_cwe_entries": 241,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,

package/data/_indexes/activity-feed.json

@@ -5,6 +5,22 @@
     "event_count": 63
   },
   "events": [
+    {
+      "date": "2026-09-29",
+      "type": "catalog_update",
+      "artifact": "data/cve-catalog.json",
+      "path": "data/cve-catalog.json",
+      "schema_version": "1.0.0",
+      "entry_count": 1759
+    },
+    {
+      "date": "2026-09-29",
+      "type": "catalog_update",
+      "artifact": "data/zeroday-lessons.json",
+      "path": "data/zeroday-lessons.json",
+      "schema_version": "1.1.0",
+      "entry_count": 1759
+    },
     {
       "date": "2026-09-28",
       "type": "skill_review",
@@ -103,22 +119,6 @@
       "path": "skills/idp-incident-response/skill.md",
       "note": "Identity-provider incident response for mid-2026 — Okta, Entra ID, Auth0, Ping, OneLogin tenant compromise, federated-trust abuse, OAuth app consent abuse, Midnight Blizzard and Scattered Spider TTPs against the IdP control plane"
     },
-    {
-      "date": "2026-09-28",
-      "type": "catalog_update",
-      "artifact": "data/cve-catalog.json",
-      "path": "data/cve-catalog.json",
-      "schema_version": "1.0.0",
-      "entry_count": 1758
-    },
-    {
-      "date": "2026-09-28",
-      "type": "catalog_update",
-      "artifact": "data/zeroday-lessons.json",
-      "path": "data/zeroday-lessons.json",
-      "schema_version": "1.1.0",
-      "entry_count": 1758
-    },
     {
       "date": "2026-09-22",
       "type": "catalog_update",

package/data/_indexes/catalog-summaries.json

@@ -53,7 +53,7 @@
       "path": "data/cve-catalog.json",
       "purpose": "Per-CVE record (CVSS, EPSS, CISA KEV, RWEP, AI-discovery, vendor advisories, framework gaps, ATLAS/ATT&CK mappings). Cross-validated against NVD + CISA KEV + FIRST EPSS via validate-cves.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-09-28",
+      "last_updated": "2026-09-29",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -62,13 +62,13 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1758,
+      "entry_count": 1759,
       "sample_keys": [
+        "CVE-2026-88772",
         "CVE-2021-1905",
         "CVE-2021-20022",
         "CVE-2021-22893",
-        "CVE-2021-38645",
-        "CVE-2021-20021"
+        "CVE-2021-38645"
       ]
     },
     "cwe-catalog.json": {
@@ -229,7 +229,7 @@
       "path": "data/zeroday-lessons.json",
       "purpose": "Distilled lessons from notable zero-days and campaigns (SesameOp, Copy Fail, Dirty Frag, Copilot RCE, Windsurf MCP). Each entry: technique, distinguishing characteristic, what it means for the framework lag.",
       "schema_version": "1.1.0",
-      "last_updated": "2026-09-28",
+      "last_updated": "2026-09-29",
       "tlp": "CLEAR",
       "source_confidence_default": "B2",
       "freshness_policy": {
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 1758,
+      "entry_count": 1759,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",

package/data/_indexes/chains.json

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/data/_indexes/chains.json
-size: 36422355 bytes
-sha256: fa9a606edd2ae06b45c401d62fb46cd219bd81d3b46d5d62a107be315185839b
+size: 36439655 bytes
+sha256: 64952ad70e77ab13b94ed35deab9bcfda1774694459fa394d370310228c9883e

package/data/attack-techniques.json

@@ -2653,6 +2653,7 @@
       "CVE-2026-85706",
       "CVE-2026-86060",
       "CVE-2026-86218",
+      "CVE-2026-88772",
       "CVE-2026-9082",
       "CVE-2026-9198",
       "CVE-2026-93952",
@@ -15410,7 +15411,8 @@
       "CVE-2025-39682",
       "CVE-2025-39964",
       "CVE-2026-20349",
-      "CVE-2026-67277"
+      "CVE-2026-67277",
+      "CVE-2026-88772"
     ]
   },
   "T1505.001": {

package/data/cve-catalog.json

@@ -1,7 +1,7 @@
 {
   "_meta": {
     "schema_version": "1.0.0",
-    "last_updated": "2026-09-28",
+    "last_updated": "2026-09-29",
     "source": "NVD + CISA KEV + vendor advisories — see sources/index.json",
     "required_fields": [
       "type",
@@ -93,6 +93,112 @@
     },
     "last_threat_review": "2026-05-30"
   },
+  "CVE-2026-88772": {
+    "name": "Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability",
+    "cvss_score": 9.5,
+    "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
+    "cwe_refs": [
+      "CWE-119"
+    ],
+    "cisa_kev": true,
+    "cisa_kev_date": "2026-09-27",
+    "cisa_kev_due_date": "2026-09-30",
+    "known_ransomware_use": false,
+    "active_exploitation": "confirmed",
+    "complexity": "high",
+    "vector": "Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway.\n\nThis issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service",
+    "epss_score": null,
+    "epss_percentile": null,
+    "epss_date": null,
+    "epss_source": null,
+    "vendor_advisories": [
+      {
+        "vendor": "Citrix",
+        "advisory_id": "CTX697096",
+        "url": "https://support.citrix.com/external/article/CTX697096",
+        "severity": "critical",
+        "published_date": "2026-09-27"
+      }
+    ],
+    "verification_sources": [
+      "https://nvd.nist.gov/vuln/detail/CVE-2026-88772",
+      "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
+      "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096&articleTitle=Citrix_NetScaler_ADC_and_Citrix_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_88771_CVE_2026_88772_CVE_2026_88773_CVE_2026_88774_CVE_2026_88775_CVE_2026_88776_CVE_2026_88777_and_CVE_2026_88778"
+    ],
+    "source_verified": "2026-09-29",
+    "last_updated": "2026-09-29",
+    "_kev_short_description": "Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of service",
+    "type": "dtls-memory-overflow-rce",
+    "blast_radius": 16,
+    "poc_available": false,
+    "poc_description": "No working exploit code for this flaw was found at a nameable public location that could be confirmed. Exploit-DB lists no entry for CVE-2026-88772, and neither the rapid7/metasploit-framework repository nor the projectdiscovery/nuclei-templates repository holds a module, template or pull request for it. A GitHub repository search for the CVE returns five repositories. The repository github.com/murrez/CVE-2026-88772 hosts a detection and fingerprint tool that identifies NetScaler build strings and can send a benign DTLS ClientHello probe, and its README states plainly that it does not include the memory-overflow trigger, which it describes as weaponized in the wild. The repository github.com/FollowerSeize/CVE-2026-88772-POC advertises a full exploit but links its actual code through an off-site shortened URL that was not opened or verified. The other three, securekomodo/citrixInspector, technion/netscaler_scanner and ThomasPoppelgaard/netscaler-ctx697096-checker, are build-fingerprinting or precondition-checking tools rather than exploits. Only the README, usage and repository description text of these repositories was read; no exploit code was opened. Citrix confirms exploitation in the wild, but a vendor statement of exploitation is not public exploit code.",
+    "iocs": {
+      "behavioral": [
+        "General hunting heuristic, not an artifact read from a source: unexplained packet-engine crashes, restarts or new NSPPE- core files under /var/core on a DTLS-enabled NetScaler ADC or Gateway, which could accompany the denial-of-service outcome Citrix describes; no source names the component that overflows. Exclude the core files and the warm restart produced by an operator's own core-file collection under Citrix CTX694799.",
+        "Suspicious administrative sessions on the appliance, unexpected outbound connections from it, or unexplained gaps in its logging; Unit 42 publishes these as general hunting guidance rather than tactics observed for this CVE."
+      ],
+      "network": [
+        "Exposure heuristic, not an exploitation signal: DTLS traffic from untrusted sources to the UDP port of any DTLS-enabled VPN virtual server or any virtual server configured with type DTLS. Each virtual server's port is set in its own configuration (the examples in Citrix bulletin CTX697096 use 443), and normal VPN clients also send DTLS, so this item marks where the flaw can be reached rather than an attack."
+      ],
+      "host": [
+        "A NetScaler configuration that leaves DTLS enabled: a VPN virtual server defined without an explicit -dtls OFF (DTLS is on by default), or a virtual server declared with type DTLS, per the precondition checks in Citrix bulletin CTX697096.",
+        "NetScaler ADC or Gateway build below the fixed releases: 14.1 before 14.1-73.37, 13.1 before 13.1-64.23, 14.1-FIPS before 14.1-73.37 FIPS, or 13.1-FIPS and 13.1-NDcPP before 13.1.37.279."
+      ],
+      "_ioc_source_note": "The DTLS precondition (DTLS enabled by default on VPN virtual servers unless -dtls OFF is set, and virtual servers configured with type DTLS in scope), the configuration examples and their port parameter, the fixed builds, and observed exploitation come from Citrix bulletin CTX697096 at https://support.citrix.com/external/article/CTX697096. The DTLS traffic item is an exposure heuristic built from those configuration examples. No published detection rule or advisory describing the malformed DTLS packet was found, so no exploitation signature is listed and the triggering packet is not reproduced. The item on packet-engine crashes is a general heuristic; Citrix CTX694799 at https://support.citrix.com/external/article/CTX694799/steps-to-take-if-netscaler-adc-is-suspec.html documents only that generating a packet-engine core file writes NSPPE- files under /var/core and performs a warm restart. The suspicious-administrative-session, unexpected-outbound-connection, and logging-gap signals come from Unit 42 at https://unit42.paloaltonetworks.com/netscaler-zero-days-exploited/, which labels them general hunting guidance and not tactics observed for this CVE. The Citrix Tech Zone blog that CTX697096 links for indicators of compromise returned HTTP 403 and could not be read; the KEV entry states that running the indicators Citrix provides in the NetScaler console may help identify exploitation, and operators should run that scan. watchTowr at https://watchtowr.com/intelligence/citrix-netscaler-zero-day-vulnerabilities-faq/, citing that blog, reports that the scan runs on the NetScaler Console Security Advisory page in NetScaler Console 14.1-73.36 or later with telemetry enabled, that the indicators can instead be requested from Citrix Support, and that Citrix warns the indicators do not cover every technique, so a clean scan does not show that an appliance was not compromised. Rapid7 at https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772/ grounds the high attack complexity and the active exploitation. From the github.com/murrez/CVE-2026-88772 repository only the README at https://raw.githubusercontent.com/murrez/CVE-2026-88772/main/README.md was read; it describes a fingerprint and benign DTLS probe tool, states that the memory-overflow trigger is not included, and lists disabling DTLS on the VPN virtual server as a mitigation. No exploit code was opened. No actor infrastructure, file hash, or C2 address is listed, because no source consulted attributes this CVE to a named campaign or operator."
+    },
+    "ai_discovered": false,
+    "ai_discovery_notes": "Citrix bulletin CTX697096 says: \"We acknowledge Michael Tucker, Chew Keong Tan and Alex Bernier of the JPMorgan Chase XOR Team, and Maxim Suhanov for working with us to protect our customers\". The acknowledgment covers all eight CVEs in the bulletin and is not tied to CVE-2026-88772, and no source names who found or reported this flaw. No source claims AI tooling was used to find it.",
+    "ai_discovery_source": "unknown",
+    "discovery_attribution_note": "Sourced from NVD CVE-2026-88772 (CWE-119, CVSS 9.5) + CISA KEV (added 2026-09-27) + Citrix advisory CTX697096. The bulletin's acknowledgment of the JPMorgan Chase XOR Team and Maxim Suhanov covers all eight CVEs it lists and does not name who found this flaw.",
+    "ai_assisted_weaponization": false,
+    "active_exploitation_notes": "CISA added CVE-2026-88772 to the KEV catalog on 2026-09-27 with a 2026-09-30 due date and lists known ransomware use as unknown. The KEV entry requires forensic triage, so under CISA BOD 26-04 federal civilian agencies must complete forensic triage as part of remediation, and the entry states that running the indicators Citrix provides in the NetScaler console may help identify exploitation. Citrix bulletin CTX697096 states exploitation of this DTLS memory-overflow flaw on unmitigated deployments has been observed, and Rapid7 notes the vendor rates its attack complexity high while confirming active exploitation. No source consulted attributes the exploitation to a named actor or campaign.",
+    "attack_refs": [
+      "T1190",
+      "T1499.004"
+    ],
+    "atlas_refs": [],
+    "framework_control_gaps": {
+      "NIST-800-53-SI-2": "SI-2 requires flaws to be identified, reported and corrected, and security-relevant updates to be installed within an organization-defined time period of their release. For CVE-2026-88772 that period starts on 2026-09-27, when Citrix released 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS and 13.1.37.279 after exploitation had begun, and Citrix published no mitigation to apply before then. The text of SI-2 does not call for an interim measure while no update exists, so reducing DTLS exposure during that period falls outside the control, although DTLS is on by default for VPN virtual servers and present on every virtual server configured with type DTLS.",
+      "NIS2-Art21-patch-management": "Article 21(2)(e) requires vulnerability handling, and for entities within the scope of Commission Implementing Regulation (EU) 2024/2690, Annex point 6.6.1 requires security patches to be applied within a reasonable time after they become available and, where a patch is not available, additional measures with the residual risk accepted, without naming the measures. For CVE-2026-88772 Citrix published neither a fix nor a mitigation until the 2026-09-27 bulletin, after exploitation had begun, so the operator had to choose the additional measures. The configuration change that the bulletin's precondition check points to, setting -dtls OFF on VPN virtual servers of type SSL, does not change virtual servers configured with type DTLS and leaves the vulnerable build in place, and the regulation does not ask that an accepted residual risk be checked against every virtual server that meets the precondition.",
+      "UK-CAF-B4": "CAF principle B4 is outcome-based, and B4.d asks that externally exposed vulnerabilities are mitigated, for example by patching, promptly, and that temporary mitigations are in place for unsupported systems and software. CVE-2026-88772 was exploited before Citrix released the fixed builds on 2026-09-27, and B4.d does not define promptly against that timeline. The affected 13.1 and 14.1 lines are supported and Citrix published no mitigation, so an operator who changes DTLS state in place of the upgrade leaves exposure behind: setting -dtls OFF takes a VPN virtual server of type SSL out of the precondition, but any virtual server configured with type DTLS still meets it. For CVE-2026-88772, an appliance with that setting on every VPN virtual server of type SSL and no virtual server of type DTLS is mitigated with residual risk. The same build remains exposed to CVE-2026-88771, which the same builds fix, which affects the default configuration with no feature enabled, and whose exploitation Citrix reports as observed, so B4.d still calls for the upgrade and that exposure is tracked as its own finding.",
+      "AU-Essential-8-Patch": "Essential Eight patching requires, at every maturity level, the operating systems of internet-facing network devices to be patched within 48 hours of release when the vendor rates the flaw critical or a working exploit exists (ISM-1877), and within two weeks when the vendor rates it non-critical and no working exploit exists (ISM-1694). For a non-internet-facing network device the window is one month at Maturity Levels One and Two (ISM-1695) and, at Maturity Level Three, 48 hours when the vendor rates the flaw critical or a working exploit exists (ISM-1696). CTX697096 rates CVE-2026-88772 critical and CISA lists it as exploited, so an internet-facing NetScaler Gateway with DTLS on, the VPN default, has 48 hours from the 2026-09-27 release, while an internal ADC that hosts a virtual server of type DTLS has one month below Maturity Level Three for the same exploited flaw. Citrix published no mitigation before that release, so no window was running while the flaw was exploited before 2026-09-27.",
+      "AU-ISM-1546": "ISM-1546 requires users to be authenticated before they are granted access to a system and its resources. CVE-2026-88772 is triggered by a crafted DTLS packet sent to a DTLS-enabled virtual server, and the CVSS vector Citrix publishes sets privileges required to none, so a DTLS-enabled VPN virtual server or a virtual server of type DTLS acts on attacker-controlled input with no authentication decision in front of it.",
+      "ISO-27001-2022-A.8.8": "A.8.8 requires vulnerability information to be obtained, exposure evaluated, and appropriate measures taken. Evaluating exposure to CVE-2026-88772 depends on knowing whether DTLS is enabled, which is the default on VPN virtual servers unless -dtls OFF is set, so an asset register that records only the build and not the DTLS state cannot judge exposure, and the appropriate measure includes a compromise assessment because a fix installed after exploitation does not remove established access."
+    },
+    "patch_available": true,
+    "patch_required_reboot": true,
+    "live_patch_available": false,
+    "live_patch_tools": [],
+    "live_patch_notes": "No reload-free patch path is documented for this flaw. The fix is the firmware upgrade to 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS, or 13.1.37.279, which reboots the appliance. watchTowr reports that on 13.1 operators should run show ns variable before upgrading and, if it returns any variables, use 13.1-64.24 to avoid a known reboot loop during the upgrade; bulletin CTX697096 names 13.1-64.23 as the fixed build and does not mention this caveat. Citrix names only the upgrade and publishes no mitigation; its bulletin states that a VPN virtual server of type SSL set with -dtls OFF does not meet the precondition, but that setting leaves the vulnerable build in place, drops DTLS transport for those virtual servers, and does not change virtual servers configured with type DTLS. Setting -dtls OFF mitigates CVE-2026-88772 with residual risk where no virtual server of type DTLS remains. The same pre-fix builds are also affected by CVE-2026-88771, which Citrix reports as exploited and which affects the default configuration with no feature enabled, so the setting does not reduce the need to install the fixed build at once. The listed builds cover the supported 13.1 and 14.1 product lines, which remain supported.",
+    "affected": "Citrix NetScaler ADC and NetScaler Gateway where DTLS is enabled; a crafted DTLS record leads to remote code execution or denial of service. DTLS is enabled by default on VPN virtual servers unless -dtls OFF is set, and virtual servers of type DTLS are also in scope. Secure Private Access Hybrid deployments that use NetScaler instances are also affected.",
+    "affected_versions": [
+      "NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.37 (fixed in 14.1-73.37), where DTLS is enabled",
+      "NetScaler ADC and NetScaler Gateway 13.1 before 13.1-64.23 (fixed in 13.1-64.23), where DTLS is enabled; watchTowr reports that a 13.1 appliance on which show ns variable returns any variables should be upgraded to 13.1-64.24 to avoid a known reboot loop during the upgrade",
+      "NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS (fixed in 14.1-73.37 FIPS), where DTLS is enabled; NVD's configuration for this CVE instead lists 14.1-FIPS builds from 14.1-66.68 through 14.1-73.37 inclusive as affected, which conflicts with the fixed build Citrix names",
+      "NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1.37.279 (fixed in 13.1.37.279), where DTLS is enabled"
+    ],
+    "vendor_update_paths": [
+      "First, because the KEV entry requires forensic triage and CISA's BOD 26-04 guidance says to collect all required evidence before patching, complete these steps on every in-scope NetScaler appliance before any configuration change, upgrade, reboot or rebuild. Run the indicators of compromise Citrix provides in the NetScaler console, as the KEV entry advises. watchTowr reports, citing the Citrix NetScaler blog, that the scan runs on the NetScaler Console Security Advisory page in NetScaler Console 14.1-73.36 or later with telemetry enabled, that the indicators can instead be requested from Citrix Support, and that Citrix warns the indicators do not cover every technique, so a clean scan does not show that the appliance was not compromised. Then, following Citrix CTX694799, record the system time, timezone settings and NTP configuration; preserve logs from remote syslog servers and NetScaler Console as well as the local logs; take a snapshot of each VPX instance; collect a technical support bundle; and generate a packet-engine core file last, because generating it performs a warm restart. On MPX and SDX hardware appliances, work with the incident response team on memory preservation and bit-for-bit disk imaging, which CTX694799 describes as powering the appliance down after memory preservation.",
+      "CTX697096 names only the upgrade under What Customers Should Do and does not present any setting as a mitigation. Its precondition check states that a VPN virtual server of type SSL set with -dtls OFF does not meet the CVE-2026-88772 precondition, and a third-party GitHub README (murrez/CVE-2026-88772) lists disabling DTLS on the VPN virtual server as a mitigation. For CVE-2026-88772 alone, an appliance with -dtls OFF on every VPN virtual server of type SSL and no virtual server of type DTLS is out of the precondition, so it is mitigated with residual risk. Setting -dtls OFF does not make it safe to defer the upgrade: every build below the fixed releases is also affected by CVE-2026-88771, which the same builds fix, which affects the default configuration with no feature enabled, and whose exploitation Citrix reports as observed. CVE-2026-88771 is not in this catalog: CISA added it to KEV on 2026-09-27 with a 2026-09-30 due date and requires forensic triage, its KEV entry describes improper input validation that could let an unauthenticated attacker execute arbitrary commands, Citrix scores it CVSS 9.5 (CVSS 4.0), public exploit code for it is available, no source records AI involvement in finding it, and it has no live patch. The setting also leaves the vulnerable build in place, drops DTLS transport for those VPN virtual servers, and does not change virtual servers configured with type DTLS (VPN or load balancing), which still meet the CVE-2026-88772 precondition.",
+      "Upgrade Citrix NetScaler ADC and NetScaler Gateway to 14.1-73.37 or 13.1-64.23; for FIPS and NDcPP appliances upgrade to 14.1-73.37 FIPS or 13.1.37.279. Before upgrading a 13.1 appliance, run show ns variable: watchTowr reports that if it returns any variables, 13.1-64.24 should be used to avoid a known reboot loop during the upgrade. Bulletin CTX697096 names 13.1-64.23 as the fixed build and does not mention this caveat, and the Citrix Tech Zone blog linked from the bulletin returned an access error and could not be read to confirm it. Applying the firmware upgrade reboots the appliance. NVD's configuration marks 14.1-73.37 FIPS itself as affected, which conflicts with the bulletin; Citrix names it as the fixed build.",
+      "Where a NetScaler instance backs a Secure Private Access Hybrid deployment, upgrade that instance to the same fixed builds.",
+      "If forensic triage finds compromise, follow CTX694799 to isolate and rebuild the appliance and rotate every credential, shared secret, certificate, and key the appliance held on their own systems."
+    ],
+    "_auto_imported": false,
+    "_intake_method": "batch-curated",
+    "rwep_factors": {
+      "cisa_kev": 25,
+      "poc_available": 0,
+      "ai_factor": 0,
+      "active_exploitation": 20,
+      "blast_radius": 16,
+      "patch_available": -15,
+      "live_patch_available": 0,
+      "reboot_required": 5
+    },
+    "rwep_score": 51,
+    "rwep_notes": "RWEP 51. cisa_kev +25, active_exploitation +20, blast_radius +16, patch_available -15, reboot_required +5. Σ factors === rwep_score."
+  },
   "CVE-2021-1905": {
     "name": "Qualcomm Multiple Chipsets Use-After-Free Vulnerability (CVE-2021-1905)",
     "cvss_score": 7.8,

package/data/cwe-catalog.json

@@ -3477,7 +3477,8 @@
       "CVE-2026-20700",
       "CVE-2026-34159",
       "CVE-2026-3910",
-      "CVE-2026-8452"
+      "CVE-2026-8452",
+      "CVE-2026-88772"
     ],
     "last_verified": "2026-05-18",
     "notes": "Added v0.13.17 KEV bulk-import."

package/data/framework-control-gaps.json

@@ -2145,6 +2145,7 @@
       "CVE-2026-86218",
       "CVE-2026-87491",
       "CVE-2026-87886",
+      "CVE-2026-88772",
       "CVE-2026-9082",
       "CVE-2026-93952",
       "CVE-2026-9586",
@@ -4691,6 +4692,7 @@
       "CVE-2026-86218",
       "CVE-2026-87491",
       "CVE-2026-87886",
+      "CVE-2026-88772",
       "CVE-2026-9082"
     ],
     "atlas_refs": [],
@@ -5670,6 +5672,7 @@
       "CVE-2026-82078",
       "CVE-2026-8452",
       "CVE-2026-85880",
+      "CVE-2026-88772",
       "CVE-2026-9082",
       "MAL-2026-3083"
     ],
@@ -8109,6 +8112,7 @@
       "CVE-2026-85880",
       "CVE-2026-86060",
       "CVE-2026-87491",
+      "CVE-2026-88772",
       "CVE-2026-9082"
     ],
     "atlas_refs": [],
@@ -13658,6 +13662,7 @@
       "CVE-2026-86218",
       "CVE-2026-87491",
       "CVE-2026-87886",
+      "CVE-2026-88772",
       "CVE-2026-9082",
       "CVE-2026-9198",
       "CVE-2026-93952",
@@ -13720,7 +13725,8 @@
       "CVE-2023-33246",
       "CVE-2023-6448",
       "CVE-2024-28987",
-      "CVE-2025-64513"
+      "CVE-2025-64513",
+      "CVE-2026-88772"
     ],
     "atlas_refs": [],
     "attack_refs": [

package/data/zeroday-lessons.json

@@ -1,7 +1,7 @@
 {
   "_meta": {
     "schema_version": "1.1.0",
-    "last_updated": "2026-09-28",
+    "last_updated": "2026-09-29",
     "last_threat_review": "2026-05-17",
     "purpose": "Zero-day learning loop output. Each entry maps a CVE to: attack vector, defense chain analysis, framework coverage, new control requirements generated, and exposure scoring. v1.1.0 (2026-05-15): every entry now carries ai_discovered_zeroday boolean + ai_discovery_source enum + ai_discovery_date + ai_assist_factor ladder, per AGENTS.md Hard Rule #7.",
     "note": "Never delete entries. Closed gaps are marked status: closed. History is data.",
@@ -17,7 +17,7 @@
       "rebuild_after_days": 365,
       "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
     },
-    "entry_count": 1758
+    "entry_count": 1759
   },
   "CVE-2026-31431": {
     "name": "Copy Fail",
@@ -145797,5 +145797,102 @@
         ]
       }
     ]
+  },
+  "CVE-2026-88772": {
+    "name": "Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability",
+    "lesson_date": "2026-09-28",
+    "ai_discovered_zeroday": false,
+    "ai_discovery_source": "unknown",
+    "ai_discovery_date": null,
+    "ai_assist_factor": "none",
+    "attack_vector": {
+      "description": "An unauthenticated attacker who sends a crafted DTLS packet to a DTLS-enabled virtual server on a NetScaler ADC or NetScaler Gateway can trigger a memory overflow that leads to remote code execution or denial of service. DTLS is enabled by default on VPN virtual servers unless -dtls OFF is set, and virtual servers configured with type DTLS are also affected.",
+      "privileges_required": "None; the CVSS vector Citrix publishes sets privileges required to none, and DTLS is on by default on VPN virtual servers unless -dtls OFF is set.",
+      "complexity": "High; the CVSS vector Citrix publishes sets attack complexity high, and Rapid7 says reliable exploitation may be more difficult for an attacker than for the input-validation flaw CVE-2026-88771 in the same bulletin.",
+      "ai_factor": "Not AI-discovered as far as any source states. The Citrix acknowledgment is not tied to this CVE, and no source claims AI tooling."
+    },
+    "defense_chain": {
+      "prevention": {
+        "what_would_have_worked": "Keeping DTLS off where DTLS transport was not needed, by setting -dtls OFF on VPN virtual servers of type SSL and not configuring virtual servers of type DTLS, which takes an appliance out of the precondition CTX697096 describes, and upgrading edge appliances on a compressed, exposure-driven schedule.",
+        "was_this_required": true,
+        "framework_requiring_it": "AU-Essential-8-Patch",
+        "adequacy": "Keeping DTLS off takes an appliance out of this flaw's precondition, which makes it mitigated with residual risk for this CVE, but it is not a mitigation Citrix publishes and it leaves the vulnerable build in place. Every build below the fixed releases is also affected by CVE-2026-88771, which Citrix reports as exploited and which affects the default configuration with no feature enabled, so DTLS being off does not make it safe to defer the upgrade. Re-enabling DTLS or adding a DTLS-type virtual server reopens CVE-2026-88772 until 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS or 13.1.37.279 is installed; on a 13.1 appliance where show ns variable returns any variables, watchTowr reports that 13.1-64.24 should be used to avoid a known reboot loop during the upgrade."
+      },
+      "detection": {
+        "what_would_have_worked": "Alerting on unexplained packet-engine crashes, restarts and NSPPE- core files under /var/core, excluding those produced by an operator's own core-file collection; watching DTLS traffic from untrusted sources to the UDP port of each DTLS-enabled virtual server; and forwarding appliance logs to a collector in a separate trust zone.",
+        "was_this_required": false,
+        "framework_requiring_it": null,
+        "adequacy": "No source names the component that overflows, so a crash is an assumed symptom of the denial-of-service outcome rather than a confirmed artifact, and a successful code-execution attempt may leave none. Normal VPN clients also send DTLS, so the traffic shows exposure rather than attack. Off-box logging matters because an attacker with code execution on the appliance can alter its local logs."
+      },
+      "response": {
+        "what_would_have_worked": "Following CISA's BOD 26-04 triage order and Citrix CTX694799 on every in-scope appliance: run the Citrix indicators of compromise in the NetScaler console; record the system time, timezone and NTP settings; preserve local, remote syslog and NetScaler Console logs; snapshot each VPX instance; collect a technical support bundle; generate a packet-engine core file, which warm-restarts the appliance; on MPX and SDX hardware, image the disks through local incident-response processes after memory preservation; then upgrade, and where compromise is found, isolate and rebuild the appliance, upgrade firmware, and rotate every credential, secret, and certificate it held.",
+        "was_this_required": true,
+        "framework_requiring_it": "CISA BOD 26-04 forensic triage (flagged in the KEV entry), for agencies bound by the directive",
+        "adequacy": "Patching in place does not evict an attacker who gained access before the fix, so the KEV entry's forensic-triage requirement calls for evidence capture and a compromise assessment ahead of any reboot or rebuild. Generating a packet-engine core file restarts the appliance, so it follows the other live collection steps."
+      }
+    },
+    "framework_coverage": {
+      "NIST-800-53-SI-2": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The period runs from the 2026-09-27 release and SI-2 asks for no interim measure, so DTLS exposure before the fix, on by default for VPN virtual servers, falls outside it."
+      },
+      "NIS2-Art21-patch-management": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Citrix published no interim measure, and disabling DTLS on SSL VPN virtual servers leaves DTLS-type virtual servers exposed, so residual-risk tracking must follow DTLS state and not just the build."
+      },
+      "UK-CAF-B4": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Promptly is not defined against exploitation that began before the 2026-09-27 fix, and a DTLS change on SSL VPN virtual servers leaves DTLS-type virtual servers exposed."
+      },
+      "AU-Essential-8-Patch": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Internet-facing appliances get 48 hours from the 2026-09-27 release, but an internal ADC hosting a DTLS virtual server gets one month below Maturity Level Three, and no window ran during the exploitation that preceded the fix."
+      },
+      "AU-ISM-1546": {
+        "covered": true,
+        "adequate": false,
+        "gap": "The flaw requires no privileges, so the appliance acts on DTLS input before any authentication and the authenticate-before-access outcome is not met at the product level."
+      },
+      "ISO-27001-2022-A.8.8": {
+        "covered": true,
+        "adequate": false,
+        "gap": "Exposure cannot be judged from the build alone because it depends on DTLS state, and the required measure must include a compromise assessment."
+      }
+    },
+    "new_control_requirements": [
+      {
+        "id": "NEW-CTRL-030",
+        "name": "PERIMETER-DEVICE-ZERODAY-SLA-TIER",
+        "description": "Internet-facing perimeter appliances are placed in a dedicated, compressed remediation tier whose clock starts at evidence of exploitation and runs faster than the general patch schedule, independent of the severity a vendor assigns.",
+        "evidence": "CVE-2026-88772 is a DTLS memory-overflow remote code execution flaw in Citrix NetScaler ADC and Gateway, KEV-listed on 2026-09-27 with active exploitation and DTLS enabled by default on VPN virtual servers per bulletin CTX697096, so this internet-facing appliance class needs a compressed remediation tier distinct from routine patching.",
+        "gap_closes": [
+          "AU-Essential-8-Patch",
+          "NIST-800-53-SI-2"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-038",
+        "name": "MITIGATION-ACTIVE-PATCH-PENDING-VERDICT-CLASS",
+        "description": "A compliance verdict distinguishes a deployed fixed build from an active configuration mitigation that leaves the vulnerable build in place, records the latter as mitigated with residual risk, and flags that reverting the configuration reopens the flaw.",
+        "evidence": "Bulletin CTX697096 states that a NetScaler VPN virtual server of type SSL set with -dtls OFF does not meet the CVE-2026-88772 precondition, while any virtual server configured with type DTLS does, and it names only the upgrade as the fix. An appliance whose build predates 14.1-73.37, 13.1-64.23, 14.1-73.37 FIPS or 13.1.37.279 on its product line, with -dtls OFF on every VPN virtual server of type SSL and no virtual server of type DTLS, is recorded for CVE-2026-88772 as mitigated with residual risk, not fixed: the vulnerable build stays in place, and re-enabling DTLS or adding a DTLS-type virtual server restores exposure without any version change. The same build remains exposed to CVE-2026-88771, which the same bulletin reports as exploited, which affects those builds in the default configuration with no feature enabled, and which the same builds close, so it is tracked as a separate open finding and the upgrade stays required.",
+        "gap_closes": [
+          "NIS2-Art21-patch-management",
+          "ISO-27001-2022-A.8.8"
+        ]
+      },
+      {
+        "id": "NEW-CTRL-032",
+        "name": "PERIMETER-COMPROMISE-REBUILD-NOT-PATCH",
+        "description": "A network-reachable appliance that suffers an actively exploited pre-authentication compromise is met with a pre-rehearsed runbook that captures forensic evidence, then rebuilds the device and rotates its stored credentials, rather than patching it in place.",
+        "evidence": "Citrix article CTX694799 tells operators who suspect NetScaler compromise to snapshot the VPX instance, capture a packet-engine core dump, isolate and rebuild the appliance, and rotate stored secrets; for the actively exploited CVE-2026-88772 that forensic-and-rebuild path takes priority over patching a possibly already-compromised device.",
+        "gap_closes": [
+          "UK-CAF-B4"
+        ]
+      }
+    ]
   }
 }