Citrix NetScaler ADC & NetScaler Gateway (AAA / SAML Gateway) Hermes rates CVE-2026-19490 at 97 (CRITICAL). As the primary perimeter security appliance safeguarding enterprise corporate intranets and virtual desktop infrastructure (VDI), authentication bypass on NetScaler Gateway completely eliminates the perimeter trust boundary. Threat actors bypass multi-factor authentication (MFA) and SAML assertions, gaining immediate unauthorized network tunneling.
Software platform affected by security vulnerabilities and agentic attack patterns.
“Confirmed security vulnerability in Citrix NetScaler ADC documented in Hermes dossier.”
| Attribute | Technical Value | Operational Impact |
|---|---|---|
| CVE Identifier | CVE-2026-19490 | Universal vulnerability identifier |
| Vendor Advisory | CTX-2026-19490 / Cloud Software Group | Official vendor security advisory |
| CVSS v3.1 / v4.0 | 9.8 / 9.3 (Critical) | Highest operational exploitation risk |
| FIRST EPSS Score | 3.37% (88.03th percentile) | High probability of sustained exploitation |
| CISA KEV Status | Added on September 9, 2026 | Mandatory remediation under BOD 26-04 |
| Vulnerable Daemon | NetScaler Packet Processing Engine (nsppe) | Network packet processing & AAA state |
| Pre-Conditions | AAA vServer or Gateway with SAML Action bound | Required deployment configuration |
| Attack Vector | Remote Unauthenticated Network (TCP 443 / SSL) | Zero prior privileges required |
| Exploitation Impact | Authentication bypass to internal network tunnel | Full perimeter perimeter collapse |
The flaw affects all active enterprise release trains of Citrix NetScaler ADC and NetScaler Gateway:
14.1-73.32;13.1-63.21;14.1-73.32 FIPS;13.1-37.277.The root cause resides in the NetScaler Packet Processing Engine (nsppe) state machine handling SAML assertion consumer service (ACS) callbacks and session token generation (categorized under CWE-288).
CVE-2026-19490 Technical Exploitation Flow:
βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β 1. Unauthenticated Remote Threat Actor β ββββββββββββββββββββββββββββββββ¬βββββββββββββββββββββββββββββββ β HTTP POST to alternate SAML path βΌ βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β 2. NetScaler Packet Processing Engine (nsppe) β β β’ Matches alternate URL pattern before AAA filter β β β’ Deserializes malformed assertion metadata β ββββββββββββββββββββββββββββββββ¬βββββββββββββββββββββββββββββββ β State machine bypass (session flag injection) βΌ βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β 3. AAA Session State Machine (ns_session) β β β’ Skips IdP cryptographic signature verification β β β’ Issues valid NSC_AAAC / NSC_USER session cookie β ββββββββββββββββββββββββββββββββ¬βββββββββββββββββββββββββββββββ β Authorized session established βΌ βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββ β 4. Full Enterprise Intranet & VDI Ingress β β β’ Established SSL VPN tunnel to internal corporate subnetsβ β β’ ICA Proxy access to Domain Controllers & workstations β βββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββββNetScaler enables complex identity federation via SAML authentication actions (add authentication samlAction). Under standard operation:
/vpn/index.html);/cgi/samlauth or /saml/login);nsppe engine validates the cryptographic signature using the stored IdP public certificate and initializes the user session structure (ns_session).In vulnerable builds, NetScaler exposed an alternate, legacy routing path within the internal HTTP request dispatcher. When an HTTP request targets this specific alternate channel with carefully tailored headers and a forged assertion payload, the validation routine evaluates the state as pre-authenticated. The validation engine fails to invoke the IdP signature verification routine, yet proceeds to write an established session token into the shared memory table.
Because the attacker supplies the SAML attributes (including NameID and UserPrincipalName), they can impersonate high-privilege corporate accounts (such as Enterprise Domain Administrators). Once the session cookie (NSC_AAAC) is minted, the Gateway permits interactive tunneling over ICA/HDX, RDP, or full layer-3 SSL VPN into internal enterprise networks.
Following initial compromise of the NetScaler Gateway session:
This campaign mirrors historical gateway exploitation campaigns seen with Cisco Secure FMC CVE-2026-20079 and Ivanti EPMM CVE-2026-1281.
Under CISA BOD 26-04, organizations deploying NetScaler ADC and Gateway must perform forensic triage to detect compromise indicators.
Access the NetScaler BSD command shell via SSH and execute the following investigative commands:
# Enter NetScaler underlying FreeBSD shellshell
# 1. Check for anomalous SAML authentication bypass requests in ns.loggzcat /var/log/ns.log* | grep -iE "(samlauth|alternate_path_indicator)" | grep "AAA_AUTH_SUCCESS"
# 2. Inspect active AAA sessions for mismatched IP/Geo anomaliesnsconmsg -d current -g aaa_tot_sessions
# 3. Detect unauthorized modifications in web server directoriesfind /netscaler/ns_gui/ /var/vpn/theme/ /var/netscaler/gui/ -type f -mtime -14 -lsFilesystem Artifacts
.php, .cgi, or .sh files in /var/vpn/theme/ or /netscaler/ns_gui/vpns/./var/core/ matching nsppe.*.core./etc/crontab or /var/spool/cron/crontabs/.Network Telemetry
title: Citrix NetScaler CVE-2026-19490 SAML Authentication Bypass Attemptid: 7c4e5192-38b1-4f27-a912-8e6f502d9914status: experimentaldescription: Detects suspicious HTTP requests attempting to bypass NetScaler Gateway authentication via alternate SAML routing channels.references: - https://support.citrix.com/article/CTX691461 - https://www.cisa.gov/known-exploited-vulnerabilities-catalogauthor: Hermes Codex Threat Intelligencedate: 2026-09-09tags: - attack.initial_access - attack.t1190 - cve.2026-19490logsource: product: netscaler service: httpaccessdetection: selection: cs-method: POST cs-uri-stem|contains: - /saml/ - /cgi/samlauth cs-uri-query|contains: - bypass - action=skip_verify condition: selectionfalsepositives: - Authorized identity provider health check probes.level: criticalalert http $EXTERNAL_NET any -> $HTTP_SERVERS any ( msg:"HERMES CODEX - Citrix NetScaler SAML Alternate Path Bypass (CVE-2026-19490)"; flow:to_server,established; content:"POST"; http_method; content:"/saml/"; http_uri; nocase; content:"RelayState="; http_client_body; pcre:"/AssertionConsumerServiceURL=[^&]*[οΏ½ /\]/i"; classtype:web-application-attack; sid:202619490; rev:1; )// Hunt for NetScaler AAA session anomalies and bypass indicatorsCommonSecurityLog| where DeviceVendor =~ "Citrix" and DeviceProduct =~ "NetScaler"| where Activity =~ "AAA_AUTH_SUCCESS" or Message has "SAML"| where RequestURL has "/saml/" or RequestURL has "/cgi/samlauth"| summarize count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, RequestURL, Message| where count() < 5| sort by LastSeen descIdentify Vulnerable Instances:
Execute the command-line audit on each appliance:
show ns runningConfig | grep -iE "(samlAction|add vpn vserver|add authentication vserver)"If SAML actions are bound to active virtual servers, the appliance requires immediate patching.
Deploy Official Firmware Builds:
Install the relevant official firmware release from Citrix Downloads:
14.1-73.32 or later;13.1-63.21 or later;14.1-73.32 FIPS or 13.1-37.277 NDcPP.Terminate Active Sessions & Invalidate Tokens:
Immediately following upgrade reboot, force-terminate all established AAA sessions to ensure compromised tokens cannot persist:
kill aaa user -allkill icaconnection -allRevoke and Reissue Certificates & SAML Signing Keys:
Rotate SAML SP/IdP private keys and reset active user credentials if compromise indicators were detected during pre-patch triage.