Detect Citrix NetScaler Authentication Bypass via Alternate Path (CVE-2026-19490) in Splunk
Detects exploitation attempts against CVE-2026-19490, a CISA KEV-listed authentication bypass (CWE-288) in Citrix NetScaler ADC and NetScaler Gateway. An attacker reaches authenticated-equivalent functionality through an alternate path or channel, bypassing primary authentication controls on the management interface (NSIP) or the Gateway/AAA virtual servers. Detection focuses on anomalous access to authenticated endpoints without a preceding successful authentication event, suspicious requests to alternate/undocumented paths, and post-exploitation session/config manipulation on NetScaler appliances. Affected products: Citrix NetScaler ADC and NetScaler Gateway (see CTX696939 for fixed builds).
MITRE ATT&CK
SPL Detection Query
index=netscaler (vendor="Citrix" OR sourcetype="citrix:netscaler:syslog" OR sourcetype="citrix:netscaler:nslog")
| rex field=_raw "(?<req_path>\/(?:vpn|cgi|nCore|admin|menu|pcidss|epa|logon)\/[^\s\"]*)"
| rex field=_raw "User\s+(?<ns_user>[^\s]+)"
| search (req_path="*" AND (NOT ns_user=* OR ns_user="-" OR ns_user="anonymous")) OR _raw="*%2e%2e*" OR _raw="*/../*"
| stats count AS hits values(req_path) AS paths values(http_status) AS statuses by src_ip dest host _time
| where hits>=3 AND (like(statuses,"%200%") OR like(statuses,"%302%"))Identifies NetScaler requests to authenticated/management paths or path-traversal alternate channels lacking an associated authenticated user, indicating CVE-2026-19490 exploitation.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Load balancer and uptime monitors polling appliance endpoints
- Authorized scanning windows against the Gateway VIP
- SAML/OAuth redirects where the first hop is unauthenticated by design
Other platforms for CVE-2026-19490
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Unauthenticated access to NetScaler management path
Expected signal: ns.log/WAF entry recording a GET to /pcidss/ with no associated user and an HTTP 200/302 response.
- Test 2Path traversal alternate-channel probe
Expected signal: Web/WAF log entry containing %2e%2e or /../ in the URL targeting the NetScaler.
- Test 3Repeated unauthenticated endpoint enumeration
Expected signal: Five unauthenticated GET requests to /cgi/ recorded within a short window from one source.
References (4)
- https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-19490
Response Playbook
Triage
- Confirm the NetScaler appliance build is vulnerable per CTX696939; record NSIP, Gateway/AAA vServer configuration, and current firmware version.
- Correlate the alerting source IP against known-good monitoring/load-balancer ranges and authorized scanner inventories to rule out benign unauthenticated traffic.
- Review ns.log and web/WAF logs for the flagged time window to determine whether the unauthenticated requests returned sensitive data or reached configuration/session endpoints.
- Check for creation of new sessions, admin accounts, or bound policies immediately following the suspicious requests.
Containment
- Apply the Citrix-provided fixed build from CTX696939; if patching is delayed, restrict NSIP/management access to a trusted jump network and disable unneeded Gateway features.
- Terminate and invalidate all active ICA/VPN and management sessions (kill nsvpn sessions; rotate the system and service account credentials).
- Block the offending source IP(s) at the perimeter and on the NetScaler responder/ACL policies.
Evidence Collection
- Export ns.log, newnslog, and the configuration (show running config) plus any shell history from the appliance for forensic preservation.
- Capture the full web/WAF and firewall logs covering the detection window, including request bodies where available.
Escalation Criteria
- !Escalate to incident response if unauthenticated requests succeeded (200/302) against management or config endpoints, indicating confirmed bypass.
- !Escalate to management and notify per regulatory obligations if new admin accounts, exfiltrated config, or lateral movement from the appliance is observed.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
/var/log/ns.log and /var/nslog/newnslog entries showing unauthenticated access to protected paths - >
NetScaler configuration diffs (new vServers, policies, bound scripts) and unexpected files under /var/netscaler/ or /flash/nsconfig/ - >
Active session tables (show aaa session / show vpn session) containing sessions with no corresponding authentication event
Tuning Guidance
Baseline legitimate unauthenticated traffic first: enumerate load-balancer health-check IPs, SSO redirect flows, and authorized scanner ranges, then exclude them via allowlists rather than loosening the path/user conditions. If your NetScaler syslog does not populate a user field on pre-auth requests, pivot the logic to response codes plus path anomalies and add rate thresholds to control volume.
Hunting Queries
Hunts for unauthenticated access to NetScaler alternate/traversal paths across the environment.
CommonSecurityLog | where DeviceVendor =~ "Citrix" | where RequestURL has_any ("/../", "%2e%2e", "/pcidss/", "/epa/") | where isempty(SourceUserName) or SourceUserName == "-" | summarize count() by SourceIP, RequestURL, bin(TimeGenerated, 1h)index=netscaler sourcetype=citrix:netscaler:syslog ("/../" OR "%2e%2e" OR "/pcidss/" OR "/epa/") | rex "User\s+(?<ns_user>[^\s]+)" | search NOT ns_user=* OR ns_user="-" | stats count by src_ip, urlAtomic Red Team Tests
Simulates a request to a protected NetScaler endpoint without authentication to generate alternate-path access telemetry.
Command
curl -sk -o /dev/null -w '%{http_code}\n' 'https://netscaler.lab.local/pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody'Cleanup
echo 'No local artifacts to clean; remove any captured response files: rm -f /tmp/ns_resp.txt'Expected Telemetry
ns.log/WAF entry recording a GET to /pcidss/ with no associated user and an HTTP 200/302 response.
Expected Detection
KQL/SPL rule fires on unauthenticated successful request to a protected NetScaler path.
Sends an encoded path-traversal request to reach functionality via an alternate path.
Command
curl -sk 'https://netscaler.lab.local/vpn/../vpns/cfg/smb.conf' -H 'User-Agent: atomic-test'Cleanup
echo 'No persistent changes made by this read-only probe.'Expected Telemetry
Web/WAF log entry containing %2e%2e or /../ in the URL targeting the NetScaler.
Expected Detection
Detection rules match on path-traversal alternate-channel indicators without authenticated user.
Issues multiple unauthenticated requests to authenticated endpoints to trigger the volume-based correlation threshold.
Command
powershell -c "1..5 | ForEach-Object { try { Invoke-WebRequest -Uri 'https://netscaler.lab.local/cgi/login' -UseBasicParsing -SkipCertificateCheck } catch {} }"Cleanup
powershell -c "Remove-Variable -Name i -ErrorAction SilentlyContinue"Expected Telemetry
Five unauthenticated GET requests to /cgi/ recorded within a short window from one source.
Expected Detection
Correlation/threshold rule fires when hits >= 3 from a single source with no user context.