Posted on

Citrix NetScaler CVE-2026-19490 – Authentication Bypass Exploitation

Threat Overview

CVE-2026-19490 is a critical authentication-bypass vulnerability affecting customer-managed NetScaler ADC and NetScaler Gateway under specific Gateway/AAA configurations. Citrix published fixes on August 19, 2026. The issue applies to appliances configured as Gateway or AAA virtual servers, with SAML-related requirements on affected 14.1 builds. Public researcher reporting later described exploitation attempts after disclosure and PoC availability. Citrix-managed cloud services were updated by Cloud Software Group.

References

Impacted Systems

  • Vendor/product: NetScaler ADC and NetScaler Gateway.
  • Affected: 14.1 before 14.1-73.32; 13.1 before 13.1-63.21; NetScaler ADC FIPS before 14.1-73.32 FIPS; 13.1 FIPS/NDcPP before 13.1-37.277.
  • Deployment: customer-managed appliances; Secure Private Access Hybrid deployments using NetScaler instances are also affected.
  • Required role: Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server; affected 14.1 configurations have SAML-action requirements documented by Citrix.
  • Cloud-managed Citrix services are not customer patch targets because Cloud Software Group applied updates.

Why this matters

NetScaler is Internet-facing identity and remote-access infrastructure. Authentication bypass can provide access at the perimeter without normal credential validation.

Exploitation Status

Citrix confirms the vulnerability and fixed builds. Researcher reporting described exploitation attempts after disclosure; Citrix’s bulletin itself does not provide attacker IOCs.

What this hunt looks for

Available Microsoft Sentinel telemetry can be reviewed for new external sources, unusual SAML/login traffic, authentication/session anomalies, correlated outbound activity, and NetScaler Syslog instability where those logs are ingested.

Required logs

Required logs vary by hunt and are identified by the Sentinel tables referenced in each query below.

Hunt 1 – First-Pass: New External Sources Reaching NetScaler Gateway or AAA

let Baseline = CommonSecurityLog
| where TimeGenerated between (ago(30d) .. ago(7d))
| summarize by SourceIP, DestinationIP;
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where DestinationPort in (443,8443)
| join kind=leftanti Baseline on SourceIP, DestinationIP
| summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), URLs=make_set(tostring(column_ifexists("RequestURL","")),30), Actions=make_set(DeviceAction,20) by SourceIP, DestinationIP
| sort by FirstSeen desc

Hunt 2 – SAML Authentication Activity Against NetScaler

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| extend Url=tostring(column_ifexists("RequestURL",""))
| where Url has_any ("saml","login","auth","vpn","gateway")
| summarize Requests=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), URLs=make_set(Url,50), Actions=make_set(DeviceAction,20) by SourceIP, DestinationHostName
| sort by LastSeen desc

Hunt 3 – Repeated Authentication or Session Activity From Rare Sources

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| extend Url=tostring(column_ifexists("RequestURL",""))
| where Url has_any ("saml","login","auth","vpn","gateway")
| summarize Requests=count(), UniqueURLs=dcount(Url), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationIP, bin(TimeGenerated,10m)
| where Requests >= 50
| sort by Requests desc

Hunt 4 – NetScaler Syslog Authentication and Session Anomalies

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("NetScaler","Citrix Gateway","AAA","SAML","SSLVPN")
| where SyslogMessage has_any ("login","authentication","session","token","denied","failed","success")
| project TimeGenerated, Computer, HostIP, ProcessName, SeverityLevel, SyslogMessage
| sort by TimeGenerated asc

Hunt 5 – Inbound Gateway Access Followed by Outbound Activity

let Inbound = CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DestinationPort in (443,8443)
| project InboundTime=TimeGenerated, ApplianceIP=DestinationIP, ExternalSource=SourceIP;
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| join kind=inner Inbound on $left.SourceIP == $right.ApplianceIP
| where TimeGenerated between (InboundTime .. InboundTime + 15m)
| where DestinationIP != ExternalSource
| project InboundTime, TimeGenerated, ApplianceIP, ExternalSource, DestinationIP, DestinationPort, Protocol, DeviceAction
| sort by InboundTime asc

Hunt 6 – NetScaler Error, Crash, or Unexpected Restart Events

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("NetScaler","Citrix Gateway","nsaaad","nsppe")
| where SyslogMessage has_any ("crash","segfault","core","restart","terminated","exception","error")
| project TimeGenerated, Computer, HostIP, ProcessName, SeverityLevel, SyslogMessage
| sort by TimeGenerated asc

Detection Notes

  • No reliable exploit-specific request signature is published in the Citrix bulletin.
  • Gateway traffic is naturally high-volume, so scope to known appliance IPs and baselines.
  • SAML and authentication logs are more useful than raw HTTPS volume.
  • CommonSecurityLog mappings vary by connector.
  • Missing appliance Syslog or reverse-proxy telemetry can prevent visibility into successful bypass activity.

Leave a comment