Citrix NetScaler Authentication Bypass

CVE-2026-19490 lets an unauthenticated remote attacker mint an anonymous, cryptographically-valid NetScaler session on any Gateway (SSL VPN / ICA Proxy / CVPN / RDP Proxy) or AAA virtual server that has SAML configured (or, on older builds, any Gateway/AAA vserver regardless of SAML). The bug is a single-instruction defect in NetScaler's SAML RelayState deserialization path: the decoded length of an attacker-controlled blob is carried forward as an internal error code and used to select which internal code branch runs next. The attacker's objective is straightforward — reach that anonymous "post-login" branch, then ride the appliance's own trust position. On a Gateway virtual server this yields a real NSC_AAAC session cookie that becomes an HTTP(S) proxy into the internal network through the clientless VPN path; if the global -defaultAuthorizationAction is left at the (non-default-in-practice) ALLOW setting, that proxy reaches internal web apps, other appliances' management interfaces, and the appliance's own NITRO configuration API — and default/reused management credentials turn that into root on the box via a one-line crontab addition.

The single highest-value defensive angle is also the simplest: patch to 14.1-73.32 / 13.1-63.21 (or the FIPS/NDcPP equivalents) immediately — there is no vendor-published workaround, and CISA added this vulnerability to the KEV catalog on 2026-09-09 with a 2026-09-12 remediation due date. Where immediate patching is impossible, set set vpn parameter -defaultAuthorizationAction DENY to bound the SSRF blast radius, and treat every SAML-configured Gateway/AAA vserver as internet-reachable and in scope for emergency hardening regardless of network diagram assumptions. This CVE is unrelated in root cause to the previously-published CVE-2026-8451 and CVE-2026-8452 NetScaler packs in this library — do not conflate scope or reuse those queries as coverage for this bug.

Eight sources were fetched directly (live pages, not search-engine summaries) and saved as verbatim plain-text snapshots in Citrix-NetScaler-CVE-2026-19490-Hunt-sources/. A ninth, higher-profile claim repeated across multiple secondary aggregator summaries — a PHP webshell at /var/vpn/theme/x.php and /var/vpn/theme/z.php — could not be corroborated in any of the eight fetched sources and is carried in this pack strictly as an unconfirmed/reported indicator (see Section 4).

Decisions & cross-reference notes

• Exploitation telemetry conflict: an earlier working assumption cited "~10 exploitation attempts from 6 unique source IPs across Australia, Germany, Japan, and the US" attributed to Rapid7. The live Rapid7 ETR post (source #2) contains no attempt counts, IP counts, or geography at all. The verified figures shipped in this pack — 56 attempts, 12 unique attacker IPs, 6 countries (AU/DE/JP/RO/TW/US), 2026-09-03 to 2026-09-09 — come from Previdian (source #6), which is independently referenced by name in the CCB Belgium government advisory (source #5), raising confidence from low to medium.
• Webshell path/filenames — UNCONFIRMED: a claim of PHP webshells at /var/vpn/theme/x.php and /var/vpn/theme/z.php recurs across search-engine-generated summaries, but none of the eight sources actually fetched (including the CCB advisory and Bishop Fox's deep technical writeup, neither of which mentions any webshell at all) contain that path or those filenames. Security Arsenal (source #8) gives only generic guidance to check /netscaler/ns_gui/, /var/vpn/, and /netscaler/portal/ for any .php/.pl/.py/.sh file — a general edge-appliance persistence pattern, not a citation of this specific path. This indicator ships in Section 4 and Section 10 labeled UNCONFIRMED, not as a verified atomic IOC.
• Companion CVE-2026-19489: patched in the same bulletin (CTX696939) — a memory-overflow DoS requiring SIP ALG enabled on an LSN group. No evidence found of in-the-wild exploitation of -19489; mentioned here for completeness only. Hunt focus stays on -19490's confirmed exploitation per scope.
• Related-but-distinct packs: CVE-2026-8451 and CVE-2026-8452 are separate, previously-published NetScaler CVEs in this library with different root causes (pre-auth RCE class per watchTowr's public research, not this SAML/RelayState auth-bypass). No IOC or query overlap was found or assumed between them and this pack.

HYPOTHESIS: If CVE-2026-19490 is being exploited against our NetScaler Gateway/AAA infrastructure, we should see POST requests to /cgi/samlauth with anomalous RelayState lengths, anonymous SSL VPN clientless-mode login log lines with no corresponding real authentication event, and — if the internal proxy path was reached — inbound connections from the NetScaler's own IP address to internal management interfaces that it has no legitimate reason to contact.

This CVE is an authentication-bypass logic bug, not malware with published hashes/C2 infrastructure. No atomic hash, IP, or domain indicators have been published by any source reviewed. The table below is behavioral/configuration indicators plus one explicitly unconfirmed reported artifact.

Non-CQL checks to run directly against the appliance or its exported config/logs — these do not require Falcon telemetry.

1. Precondition inventory (per Citrix bulletin CTX696939): on each appliance, run show ns runningConfig | grep -i saml and separately grep the running config for add authentication vserver .* and add vpn vserver .*. Any appliance matching one or more is in scope regardless of internet-exposure assumptions.
2. Safe external patch-state check: Bishop Fox published an open-source, non-destructive verifier (github.com/BishopFox/CVE-2026-19490-check, not reproduced here) that sends one SAML POST with RelayState decoded to exactly 20 bytes and reads the response: HTTP 500 / internal error 43524 = unpatched; HTTP 200 / "Malformed Assertion" = patched. Safe to run against production — it never touches the crash-length (18/21) or session-creating (11/16) branches.
3. Appliance-side triage: find /netscaler/ns_gui /var/vpn /netscaler/portal -type f \( -name "*.php" -o -name "*.pl" -o -name "*.py" -o -name "*.sh" \) — flags any script file in a web-served directory, including but not limited to the unconfirmed x.php/z.php claim (Section 4). Cross-reference every hit against a documented, ticketed customization before treating it as benign.
4. Shell/AAA log review (30+ days retroactive): tail -200 /var/log/shell.log, tail -100 /var/log/bash.log, and grep -iE "login|authentication" /var/log/ns.log — look specifically for authentication log entries with no preceding legitimate login flow, and any shell command not tied to a known change ticket.
5. Config-integrity diff: compare current ns.conf against the last known-good backup; unauthorized vserver bindings, added routes, or new responder/rewrite policies are classic persistence moves on compromised NetScaler appliances.

NetScaler ADC/Gateway is a FreeBSD-based appliance and does not run a Falcon sensor. Queries Q1, Q2, Q3, Q7, and Q8 target NetScaler AAA/access logs forwarded via a syslog/CEF connector into Falcon Next-Gen SIEM — their field names are illustrative snake_case NG-SIEM parser fields and must be validated against a real sample row from your own syslog connector before deployment (fields are parser-prefixed per tenant, same caveat as SaaS/IdP ingest). Queries Q4, Q5, and Q6 are Falcon-native and run against downstream endpoints with actual sensor coverage (jump hosts, log collectors, management workstations) that the SSRF pivot could reach.

// HUNT: NetScaler SAML RelayState Auth-Bypass Probe/Exploitation (CVE-2026-19490)
// MITRE: T1190 - Exploit Public-Facing Application
// CONF: medium
// FP: low
// COST: low
// REQUIRES: NetScaler AAA/access logs (ns.log or equivalent) forwarded via syslog/CEF into Falcon Next-Gen SIEM. Field names are illustrative snake_case NG-SIEM parser fields -- validate against a real sample forwarded row for your connector before deploying.
// FALSE POSITIVES: Vulnerability scanners and Bishop-Fox-style safe patch-state probes intentionally send this exact 20-byte-RelayState request to CHECK for the bug -- expected and benign from your own team's infrastructure.
// TUNING: Exclude src_ip values belonging to your own vulnerability-management/scanning subnets before alerting; a single hit from an unrecognized external src_ip against /cgi/samlauth warrants review, high volume from one src_ip is the stronger signal.
// LOOKBACK: 14d

http_path = "/cgi/samlauth"
| http_method = "POST"
| (http_status = "500" and message = *43524*) or (http_status = "200" and message like "*Malformed Assertion*")
| groupBy([src_ip, ns_hostname, http_status], function=[count(as=Hits), collect(message)], limit=500)
| sort(Hits, order=desc)

// HUNT: NetScaler Packet-Engine Crash Sweep via Crafted RelayState Length (CVE-2026-19490)
// MITRE: T1499.004 - Endpoint Denial of Service: Application or System Exploitation
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: NetScaler AAA/access logs forwarded via syslog/CEF into Falcon Next-Gen SIEM, plus appliance restart/uptime telemetry if available. Field names are illustrative snake_case NG-SIEM parser fields -- validate against a real sample row for your connector.
// FALSE POSITIVES: Aggressive but authorized vulnerability scanners or the Bishop-Fox-style safe detection tool can generate repeated 500-class responses against /cgi/samlauth during sanctioned testing windows.
// TUNING: Exclude src_ip ranges belonging to your own scanning/testing infrastructure and any documented patch-verification window before alerting; escalate immediately if the appliance also logged an unplanned packet-engine restart in the same window.
// LOOKBACK: 7d

http_path = "/cgi/samlauth"
| http_method = "POST"
| http_status = "500"
| groupBy([src_ip, ns_hostname], function=[count(as=Hits)], limit=500)
| test(Hits >= 3)
| sort(Hits, order=desc)

// HUNT: NetScaler Anonymous SSLVPN Session to Clientless-Proxy Pivot (CVE-2026-19490)
// MITRE: T1090.001 - Proxy: Internal Proxy
// CONF: high
// FP: low
// COST: low
// REQUIRES: NetScaler AAA/access logs (ns.log) forwarded via syslog/CEF into Falcon Next-Gen SIEM. Validate the exact log-line wording against a real sample from your NetScaler build/version -- the "anonymous" clientless-mode login string is documented on unpatched builds per Bishop Fox's technical analysis.
// FALSE POSITIVES: None expected -- a genuine anonymous/unauthenticated SSL VPN clientless login is not a normal outcome of standard NetScaler operation absent this bug or a deliberate guest-access configuration.
// LOOKBACK: 30d

message like "*SSLVPN LOGIN*"
| message like "*anonymous*"
| (http_path = "/cgi/setclient*" or http_path like "*cvpn*")
| groupBy([src_ip, ns_hostname], function=[count(as=Hits), collect(message)], limit=500)
| sort(Hits, order=desc)

// HUNT: Inbound Connections From NetScaler Appliance IP to Internal Management Ports (Possible SSRF Pivot, CVE-2026-19490)
// MITRE: T1090.001 - Proxy: Internal Proxy
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: Falcon sensor coverage on the internal Windows/Linux/management hosts a compromised NetScaler's clientless-VPN proxy could reach. NetScaler itself runs no Falcon sensor (FreeBSD appliance).
// FALSE POSITIVES: The NetScaler appliance legitimately talks to internal hosts for load-balancing health checks, LDAP/RADIUS auth backends, and monitoring -- baseline your NetScaler's normal internal talk-to list before alerting.
// TUNING: Exclude RemoteAddressIP4/LocalPort pairs matching your NetScaler's documented health-check/LDAP/RADIUS backend list; escalate on connections to NITRO API ports or other appliances' management UIs that fall outside that baseline.
// LOOKBACK: 14d

#event_simpleName = NetworkReceiveAcceptIP4
| RemoteAddressIP4 = "REPLACE_WITH_NETSCALER_NSIP_OR_VIP"
| in(LocalPort, values=[443, 3008, 3009, 3010, 3011, 4433, 8443])
| table([@timestamp, ComputerName, UserName, RemoteAddressIP4, LocalPort, LocalAddressIP4, aid])
| sort(@timestamp, order=desc)

// HUNT: Root Cron Persistence Following Suspicious NITRO/API Configuration Activity (CVE-2026-19490)
// MITRE: T1053.003 - Scheduled Task/Job: Cron
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: Falcon sensor coverage (Linux) on any jump host, log collector, or management workstation from which NetScaler NITRO API sessions are proxied. NetScaler's own FreeBSD OS runs no Falcon sensor -- this hunt covers the credentialed pivot Bishop Fox documented, which requires a Falcon-covered Linux host somewhere in the chain to be directly observable.
// FALSE POSITIVES: Legitimate configuration-management tools (Ansible, Puppet, Chef, cron-based backup jobs) routinely modify crontab entries.
// TUNING: Exclude ParentBaseFileName values matching your approved CM/orchestration tooling (e.g. ansible-playbook, puppet, chef-client) and any documented maintenance window before alerting.
// LOOKBACK: 14d

#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| CommandLine = /crontab/i
| FileName = /^(crontab|sh|bash)$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid])
| sort(@timestamp, order=desc)

// HUNT: Reported (UNCONFIRMED) NetScaler Webshell Basenames on Monitored Hosts (CVE-2026-19490)
// MITRE: T1505.003 - Server Software Component: Web Shell
// CONF: low
// FP: high
// COST: low
// REQUIRES: Falcon sensor coverage (Linux) on any host that mirrors, syncs, or processes NetScaler web-served content -- the NetScaler appliance itself runs no Falcon sensor. IMPORTANT: the path/filenames here are UNCONFIRMED -- multiple secondary sources repeat a claim of PHP webshells named x.php / z.php in a NetScaler theme directory, but this could NOT be independently verified against the Citrix bulletin, the CCB Belgium advisory, the Rapid7 ETR post, or Bishop Fox's technical writeup (none of which mention any webshell). Treat any hit as a lead requiring manual appliance-side verification, never as a confirmed compromise indicator on its own. See Section 2 for full provenance notes.
// FALSE POSITIVES: Any legitimately named x.php/z.php file unrelated to this threat; generic script files from approved deployment/customization tooling.
// TUNING: Exclude paths matching documented, change-ticketed NetScaler theme/portal customizations before alerting; require manual appliance-side verification (e.g. find /var/vpn -name "*.php") before treating any hit as confirmed compromise.
// LOOKBACK: 30d

#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2|NewExecutableWritten/
| FileName = /^[xz]\.php$/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, aid])
| sort(@timestamp, order=desc)

// HUNT: NetScaler Configuration Changes via NITRO Outside Change Window (Possible Default/Reused-Credential Abuse, CVE-2026-19490)
// MITRE: T1078.001 - Valid Accounts: Default Accounts
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: NetScaler audit/config logs (ns.log "save ns config" / "add vpn vserver" / "add authentication" / "add system user" lines) forwarded via syslog/CEF into Falcon Next-Gen SIEM. Field names are illustrative snake_case NG-SIEM parser fields -- validate against a real sample row for your connector.
// FALSE POSITIVES: Scheduled/ticketed maintenance windows, legitimate NetScaler admin configuration changes, HA sync operations.
// TUNING: Exclude admin_user values belonging to named, ticketed change-management sessions and your documented maintenance windows before alerting.
// LOOKBACK: 30d

message like "*save ns config*" or message like "*add vpn vserver*" or message like "*add authentication*" or message like "*add system user*"
| groupBy([src_ip, ns_hostname, admin_user], function=[count(as=Hits), collect(message)], limit=500)
| sort(Hits, order=desc)

// HUNT: Distributed Scanning of NetScaler SAML/AAA Endpoints (Pre-Exploitation Recon, CVE-2026-19490)
// MITRE: T1190 - Exploit Public-Facing Application
// CONF: medium
// FP: medium
// COST: medium
// REQUIRES: NetScaler access logs forwarded via syslog/CEF into Falcon Next-Gen SIEM. Field names are illustrative snake_case NG-SIEM parser fields -- validate against a real sample row for your connector.
// FALSE POSITIVES: Authorized external/internal vulnerability scanning (InsightVM, Qualys, Nessus, Bishop Fox's public detection tool) will match this pattern by design.
// TUNING: Exclude src_ip ranges belonging to your own or a contracted vulnerability-management vendor's scanning infrastructure before alerting.
// LOOKBACK: 7d

in(http_path, values=["/cgi/samlauth", "/cgi/login", "/vpn/index.html", "/logon/LogonPoint"])
| groupBy([src_ip], function=[count(as=Hits)], limit=500)
| test(Hits >= 20)
| sort(Hits, order=desc)

Custom IOAs apply to Falcon-covered endpoints in the blast radius (jump hosts, log collectors, management workstations) — not to the NetScaler appliance itself, which cannot run a Falcon sensor.

Custom IOA: Unexpected Egress From NetScaler-Adjacent Management Host

Rule Group: Network / Edge-Appliance Pivot Defense  ·  Rule Type: Network Connection  ·  Action: Detect  ·  Severity: Medium  ·  MITRE: T1090.001

Detection Logic: Flag outbound connections from a host in the NetScaler management/jump-host sensor group to a destination outside an allowlisted internal range and outside DNS/NTP/licensing ports, immediately following an inbound connection from the NetScaler's own NSIP/VIP.

Description: Approximates Security Arsenal's "suspicious outbound connection from NetScaler appliance to rare external host" Sigma concept for the Falcon-covered side of the chain (the appliance itself has no sensor).

FP Tuning Notes: Baseline the management host's normal talk-to list (patch mirrors, monitoring, backup targets) for at least 14 days before enabling; exclude those first.

Recommended Validation: From an isolated canary host in the same sensor group, initiate a benign outbound connection to a non-allowlisted internal test address after simulating an inbound connection from a test NetScaler IP; confirm the rule fires in Detect mode before considering Block.

Custom IOA: Crontab Write by Non-CM Process

Rule Group: Linux Persistence  ·  Rule Type: Process Creation  ·  Action: Detect  ·  Severity: High  ·  MITRE: T1053.003

Detection Logic: Image Filename: .*/(crontab)$  ·  Parent Image Filename: NOT matching your approved CM/orchestration tooling list (ansible, puppet, chef, cron-package-manager hooks).

Description: Catches the documented "NITRO file interface appends a one-shot crontab line, cron runs it as root within ~1 minute" persistence step on any Falcon-covered Linux host in the NITRO-access chain.

FP Tuning Notes: Exclude your CM tooling's parent process names; run in Detect mode for 14+ days and measure FP rate before any promotion discussion.

Recommended Validation: On an isolated test VM, run crontab -l | { cat; echo "* * * * * /bin/true"; } | crontab - from a shell that is NOT your CM tool's parent process, confirm the rule fires, then remove the test entry.

Queries must be run manually in Falcon LogScale; this pack cannot execute them. "Expected Findings" in Section 16 describes what a positive result looks like so the analyst knows what to look for.

TTP: CVE-2026-19490 authentication bypass  ·  MITRE Technique: T1190  ·  Primary Mitigations: M1051, M1042, M1032, M1030, M1029, M1018

What to verify after deployment

• show ns runningConfig | grep -i saml and re-run the config-audit strings (Section 10) after patching to confirm precondition strings still map to a patched build version.
• Bishop Fox's safe 20-byte-RelayState probe should now return HTTP 200 / "Malformed Assertion" on every scoped virtual server.
• Re-run Q1 and Q3 (Section 8) for 7 days post-patch — a continued anonymous-session log line after patching indicates the patch did not take on that node.

MITRE: T1190 → M1051, M1042  ·  Estimated deploy time: 1–3 hours per HA pair (patch download/stage/reboot dependent)  ·  Prerequisites: Console/SSH access to each NetScaler appliance, current firmware image staged  ·  Reboot required: Yes, for the firmware upgrade step

Step 1 — Inventory and precondition check

What it does: Confirms which appliances are in scope before touching anything. Why it works: CTX696939's own precondition strings are authoritative for what's exploitable per build.

# Run on each NetScaler appliance shell
show ns version
show ns runningConfig | grep -i saml
show ns runningConfig | grep -E "add authentication vserver|add vpn vserver"

Verify: Record build number and whether SAML/Gateway/AAA config is present for each appliance; cross-reference against the fixed-version table in Section 5.

Step 2 — Apply the vendor patch

What it does: Closes the deserialization-length bug at its root (a single instruction change per Bishop Fox's binary diff). Why it works: MITRE M1051 — Update Software.

# Standard Citrix firmware upgrade process -- obtain the exact fixed build
# for your release train from the official bulletin before upgrading:
# https://support.citrix.com  (search: CTX696939)
# Minimum fixed builds: 14.1-73.32 / 13.1-63.21 / 14.1-73.32 FIPS / 13.1-37.277 FIPS-NDcPP
# Patch BOTH nodes of any HA pair -- an unpatched secondary is fully exposed
# the moment it takes over.

Verify: show ns version reflects the fixed build on both HA nodes; re-run Bishop Fox's safe probe (Section 7, item 2) and confirm HTTP 200 / "Malformed Assertion" on every scoped vserver.

Step 3 — Bound the blast radius (compensating control, pre- or post-patch)

What it does: Prevents an anonymous Gateway session from being used as an SSRF proxy into the internal network. Why it works: MITRE M1042 — Disable or Remove Feature or Program.

# NetScaler CLI
set vpn parameter -defaultAuthorizationAction DENY
save ns config

Verify: show vpn parameter should report defaultAuthorizationAction: DENY.

Step 4 — Harden the management plane

What it does: Removes reliance on static local admin credentials that a successful SSRF-to-NITRO pivot could otherwise abuse. Why it works: MITRE M1032 — Multi-factor Authentication.

# NetScaler CLI -- configure TACACS+ or RADIUS-backed admin auth
# (exact server/shared-secret values are environment-specific; consult
# your NetScaler administration guide for the "add authentication
# tacacsAction" / "add authentication radiusAction" syntax for your
# firmware version before applying in production)
show system user
# Confirm no unexpected local accounts exist beyond documented break-glass admin(s)

Verify: show system user shows only documented accounts; admin logins now route through TACACS+/RADIUS in the AAA logs.

Deploying via your RMM

The steps above are raw NetScaler CLI. To wrap them for fleet-wide execution (change-ticket linkage, staged rollout across HA pairs, compliance writeback), hand them to your RMM/orchestration tooling and ask for a deployable package.

Coverage Summary: 6 of 6 mapped techniques have at least partial detection coverage; 8 CQL queries and 2 Custom IOA recommendations shipped. The clearest priority gap is native NITRO API audit-log ingestion into Falcon — today that control lives only as a manual native hunt (Section 7) because NetScaler's NITRO audit trail is not commonly forwarded in a structured way; if your syslog connector exposes NITRO API call logs, extend Q7 to key on the specific API session/user field rather than only config-changing keywords.

All five Detection Validation Gates from Section 11 apply before any of the above move beyond hunt/Detect mode.

Related-but-distinct prior library coverage: CVE-2026-8451 and CVE-2026-8452 (separate NetScaler CVEs, different root cause — not merged into this pack's scope).