Citrix NetScaler Authentication Bypass via Alternate Path (CVE-2026-19490)

let authEndpoints = dynamic(["/vpn/", "/cgi/", "/nCore/", "/admin/", "/menu/", "/pcidss/"]);
CommonSecurityLog
| where DeviceVendor =~ "Citrix" and DeviceProduct has_any ("NetScaler", "ADC", "Gateway")
| extend ReqPath = tostring(RequestURL)
| where ReqPath has_any (authEndpoints) or ReqPath has_any ("/../", "%2e%2e", "/epa/", "/logon/LogonPoint")
| where (isempty(SourceUserName) or SourceUserName =~ "-" or SourceUserName =~ "anonymous")
| where RequestMethod in ("POST", "GET") and toint(coalesce(tostring(extract("([0-9]{3})", 1, tostring(ResponseCode))), "0")) in (200, 302)
| summarize Hits = count(), Paths = make_set(ReqPath, 20) by SourceIP, DeviceName, bin(TimeGenerated, 10m)
| where Hits >= 3

index=netscaler (vendor="Citrix" OR sourcetype="citrix:netscaler:syslog" OR sourcetype="citrix:netscaler:nslog")
| rex field=_raw "(?<req_path>\/(?:vpn|cgi|nCore|admin|menu|pcidss|epa|logon)\/[^\s\"]*)"
| rex field=_raw "User\s+(?<ns_user>[^\s]+)"
| search (req_path="*" AND (NOT ns_user=* OR ns_user="-" OR ns_user="anonymous")) OR _raw="*%2e%2e*" OR _raw="*/../*"
| stats count AS hits values(req_path) AS paths values(http_status) AS statuses by src_ip dest host _time
| where hits>=3 AND (like(statuses,"%200%") OR like(statuses,"%302%"))

sequence by source.ip with maxspan=10m
  [network where event.dataset : "citrix.netscaler" and url.path : ("/vpn/*", "/cgi/*", "/nCore/*", "/admin/*", "/pcidss/*", "/epa/*") and (url.original : ("*%2e%2e*", "*/../*") or user.name : ("-", "anonymous", null))]
  [network where event.dataset : "citrix.netscaler" and http.response.status_code in (200, 302) and (user.name : ("-", "anonymous", null))]

SELECT sourceip, destinationip, "URL" AS req_path, "Username" AS user, COUNT(*) AS hits FROM events WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Citrix%' AND ("URL" ILIKE '/vpn/%' OR "URL" ILIKE '/cgi/%' OR "URL" ILIKE '/nCore/%' OR "URL" ILIKE '/admin/%' OR "URL" ILIKE '/pcidss/%' OR "URL" ILIKE '%/../%' OR "URL" ILIKE '%2e%2e%') AND ("Username" IS NULL OR "Username" = '-' OR "Username" ILIKE 'anonymous') GROUP BY sourceip, destinationip, req_path, user HAVING COUNT(*) >= 3 LAST 1 HOURS

_sourceCategory=*citrix*netscaler* ("/vpn/" OR "/cgi/" OR "/nCore/" OR "/admin/" OR "/pcidss/" OR "/../" OR "%2e%2e")
| parse "* - * \"* *" as src_ip, user, method, req_path nodrop
| where (isBlank(user) OR user = "-" OR user matches "anonymous")
| count as hits by src_ip, req_path
| where hits >= 3

rule citrix_netscaler_auth_bypass_cve_2026_19490 {
  meta:
    author = "Argus"
    description = "NetScaler auth bypass via alternate path (CVE-2026-19490)"
    severity = "CRITICAL"
  events:
    $e.metadata.vendor_name = "Citrix"
    $e.target.url re `(?i)(/vpn/|/cgi/|/nCore/|/admin/|/pcidss/|/\.\./|%2e%2e)`
    ($e.principal.user.userid = "" or $e.principal.user.userid = "-" or $e.principal.user.userid = /anonymous/)
    $e.network.http.response_code = 200 or $e.network.http.response_code = 302
    $ip = $e.principal.ip
  match:
    $ip over 10m
  condition:
    #e >= 3
}

#event_simpleName=/.*/
| Vendor=/Citrix/i
| UrlPath=/(?i)(\/vpn\/|\/cgi\/|\/nCore\/|\/admin\/|\/pcidss\/|\/\.\.\/|%2e%2e)/
| (UserName="" OR UserName="-" OR UserName=/(?i)anonymous/)
| (HttpStatusCode=200 OR HttpStatusCode=302)
| groupBy([aid, RemoteAddressIP4], function=count(as=hits))
| hits >= 3