VORANT. Threat Intelligence Sign in Get the full feed

Citrix NetScaler auth bypass flaw sees PoC released

severe vulnerability technologyinfrastructure

NCSC-NL warns of a NetScaler ADC/Gateway auth bypass with public PoC and likely imminent exploitation, plus a related memory overflow flaw.

Citrix has patched two vulnerabilities in NetScaler ADC and NetScaler Gateway. CVE-2026-19490 is an authentication bypass using an alternate path or channel (CVSS v4 9.3), allowing an attacker to circumvent normal authentication and gain unauthorized access. It affects devices configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy), an AAA virtual server, or as a SAML Identity Provider (the latter an uncommon configuration). Proof-of-concept code for this flaw is now publicly available, and NCSC-NL assesses it very likely that exploitation will occur in the short term.

CVE-2026-19489 is a memory overflow (improper restriction of operations within the bounds of a memory buffer, CVSS v4 8.8) affecting NetScaler ADC/Gateway when configured as a SIP ALG within a Large Scale NAT (LSN) group, which can cause unpredictable behavior or denial of service.

Citrix has released updates addressing both issues. Given the availability of PoC code for the authentication bypass and the high likelihood of imminent exploitation, NCSC-NL rated this advisory as high priority. Defenders running NetScaler ADC/Gateway in the affected configurations should prioritize patching immediately and review authentication logs for anomalous access via Gateway, AAA, or SAML IdP configurations.

Mentioned in this report

Vulnerabilities CVE-2026-19489CVE-2026-19490KEV

Related reporting

Detection guidance

Citrix NetScaler SAML IdP Direct Access Without Authentication

ATT&CK T1190

Detects direct access to Citrix NetScaler SAML Identity Provider endpoints by unauthenticated clients, exploiting CVE-2026-19490 authentication bypass in uncommon SAML configurations. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Citrix NetScaler SAML IdP Direct Access Without Authentication
description: Detects HTTP requests to SAML endpoint paths on NetScaler with successful
  responses (200/302) but no valid session cookie or Authorization header, indicating
  bypass of SAML IdP authentication.
tags:
- attack.t1190
- attack.t1212
logsource:
  category: proxy
  product: citrix_netscaler
detection:
  selection_saml_direct:
    cs-uri-stem|contains:
    - /saml/
    - /samlsp/
    - /saml-
    sc-status:
    - 200
    - 302
  selection_no_valid_session:
    cs-cookie|all:
    - null
    Authorization: null
  filter_metadata:
    cs-uri-stem|contains: /metadata
  filter_logout:
    cs-uri-stem|contains: /logout
  condition: selection_saml_direct and selection_no_valid_session and not filter_metadata
    and not filter_logout
falsepositives:
- SAML metadata endpoint public availability (intentional design)
- Service-to-service SAML assertions without client-side cookie storage
level: high
id: d5498100-1f81-52ac-8769-62a28636cfcb
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0318.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free