CVE-2026-19490 Google Chronicle · YARA-L

Detect Citrix NetScaler Authentication Bypass via Alternate Path (CVE-2026-19490) in Google Chronicle

Detects exploitation attempts against CVE-2026-19490, a CISA KEV-listed authentication bypass (CWE-288) in Citrix NetScaler ADC and NetScaler Gateway. An attacker reaches authenticated-equivalent functionality through an alternate path or channel, bypassing primary authentication controls on the management interface (NSIP) or the Gateway/AAA virtual servers. Detection focuses on anomalous access to authenticated endpoints without a preceding successful authentication event, suspicious requests to alternate/undocumented paths, and post-exploitation session/config manipulation on NetScaler appliances. Affected products: Citrix NetScaler ADC and NetScaler Gateway (see CTX696939 for fixed builds).

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule citrix_netscaler_auth_bypass_cve_2026_19490 {
  meta:
    author = "Argus"
    description = "NetScaler auth bypass via alternate path (CVE-2026-19490)"
    severity = "CRITICAL"
  events:
    $e.metadata.vendor_name = "Citrix"
    $e.target.url re `(?i)(/vpn/|/cgi/|/nCore/|/admin/|/pcidss/|/\.\./|%2e%2e)`
    ($e.principal.user.userid = "" or $e.principal.user.userid = "-" or $e.principal.user.userid = /anonymous/)
    $e.network.http.response_code = 200 or $e.network.http.response_code = 302
    $ip = $e.principal.ip
  match:
    $ip over 10m
  condition:
    #e >= 3
}
critical severity medium confidence

YARA-L 2.0 rule matching repeated successful unauthenticated requests to NetScaler protected/alternate paths from a single source.

Data Sources

Citrix NetScaler SyslogChronicle UDM HTTP events

Required Tables

udm.events

False Positives & Tuning

  • Load-balancer health probes
  • Unattributed monitoring traffic
  • Authorized scanners

Other platforms for CVE-2026-19490

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Unauthenticated access to NetScaler management path

    Expected signal: ns.log/WAF entry recording a GET to /pcidss/ with no associated user and an HTTP 200/302 response.

  2. Test 2Path traversal alternate-channel probe

    Expected signal: Web/WAF log entry containing %2e%2e or /../ in the URL targeting the NetScaler.

  3. Test 3Repeated unauthenticated endpoint enumeration

    Expected signal: Five unauthenticated GET requests to /cgi/ recorded within a short window from one source.

Last updated: 2026-09-10 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the NetScaler appliance build is vulnerable per CTX696939; record NSIP, Gateway/AAA vServer configuration, and current firmware version.
  2. Correlate the alerting source IP against known-good monitoring/load-balancer ranges and authorized scanner inventories to rule out benign unauthenticated traffic.
  3. Review ns.log and web/WAF logs for the flagged time window to determine whether the unauthenticated requests returned sensitive data or reached configuration/session endpoints.
  4. Check for creation of new sessions, admin accounts, or bound policies immediately following the suspicious requests.

Containment

  1. Apply the Citrix-provided fixed build from CTX696939; if patching is delayed, restrict NSIP/management access to a trusted jump network and disable unneeded Gateway features.
  2. Terminate and invalidate all active ICA/VPN and management sessions (kill nsvpn sessions; rotate the system and service account credentials).
  3. Block the offending source IP(s) at the perimeter and on the NetScaler responder/ACL policies.

Evidence Collection

  1. Export ns.log, newnslog, and the configuration (show running config) plus any shell history from the appliance for forensic preservation.
  2. Capture the full web/WAF and firewall logs covering the detection window, including request bodies where available.

Escalation Criteria

  • !Escalate to incident response if unauthenticated requests succeeded (200/302) against management or config endpoints, indicating confirmed bypass.
  • !Escalate to management and notify per regulatory obligations if new admin accounts, exfiltrated config, or lateral movement from the appliance is observed.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >/var/log/ns.log and /var/nslog/newnslog entries showing unauthenticated access to protected paths
  • >NetScaler configuration diffs (new vServers, policies, bound scripts) and unexpected files under /var/netscaler/ or /flash/nsconfig/
  • >Active session tables (show aaa session / show vpn session) containing sessions with no corresponding authentication event

Tuning Guidance

Baseline legitimate unauthenticated traffic first: enumerate load-balancer health-check IPs, SSO redirect flows, and authorized scanner ranges, then exclude them via allowlists rather than loosening the path/user conditions. If your NetScaler syslog does not populate a user field on pre-auth requests, pivot the logic to response codes plus path anomalies and add rate thresholds to control volume.

Hunting Queries

Hunts for unauthenticated access to NetScaler alternate/traversal paths across the environment.

Hunting — KQL
kql 
CommonSecurityLog | where DeviceVendor =~ "Citrix" | where RequestURL has_any ("/../", "%2e%2e", "/pcidss/", "/epa/") | where isempty(SourceUserName) or SourceUserName == "-" | summarize count() by SourceIP, RequestURL, bin(TimeGenerated, 1h)
Hunting — SPL
spl 
index=netscaler sourcetype=citrix:netscaler:syslog ("/../" OR "%2e%2e" OR "/pcidss/" OR "/epa/") | rex "User\s+(?<ns_user>[^\s]+)" | search NOT ns_user=* OR ns_user="-" | stats count by src_ip, url

Atomic Red Team Tests

Test 1 Unauthenticated access to NetScaler management path
linux

Simulates a request to a protected NetScaler endpoint without authentication to generate alternate-path access telemetry.

Command

bash 
curl -sk -o /dev/null -w '%{http_code}\n' 'https://netscaler.lab.local/pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody'

Cleanup

bash 
echo 'No local artifacts to clean; remove any captured response files: rm -f /tmp/ns_resp.txt'

Expected Telemetry

ns.log/WAF entry recording a GET to /pcidss/ with no associated user and an HTTP 200/302 response.

Expected Detection

KQL/SPL rule fires on unauthenticated successful request to a protected NetScaler path.

Test 2 Path traversal alternate-channel probe
linux

Sends an encoded path-traversal request to reach functionality via an alternate path.

Command

bash 
curl -sk 'https://netscaler.lab.local/vpn/../vpns/cfg/smb.conf' -H 'User-Agent: atomic-test'

Cleanup

bash 
echo 'No persistent changes made by this read-only probe.'

Expected Telemetry

Web/WAF log entry containing %2e%2e or /../ in the URL targeting the NetScaler.

Expected Detection

Detection rules match on path-traversal alternate-channel indicators without authenticated user.

Test 3 Repeated unauthenticated endpoint enumeration
windows

Issues multiple unauthenticated requests to authenticated endpoints to trigger the volume-based correlation threshold.

Command

powershell 
powershell -c "1..5 | ForEach-Object { try { Invoke-WebRequest -Uri 'https://netscaler.lab.local/cgi/login' -UseBasicParsing -SkipCertificateCheck } catch {} }"

Cleanup

powershell 
powershell -c "Remove-Variable -Name i -ErrorAction SilentlyContinue"

Expected Telemetry

Five unauthenticated GET requests to /cgi/ recorded within a short window from one source.

Expected Detection

Correlation/threshold rule fires when hits >= 3 from a single source with no user context.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege Escalation

Related Techniques

T1190Exploit Public-Facing ApplicationT1078Valid Accounts

Same Tactic: Initial Access

Popular Detections