NetScaler SAML Auth Bypass (CVE-2026-19490)

Overview

A version-only scan can miss CVE-2026-19490 when a NetScaler build is unreadable. This workflow confirms the vulnerable SAML configuration with a non-intrusive safe oracle and returns the observed config for each detected host. CVE-2026-19490 is an unauthenticated authentication bypass in the SAML HTTP-Redirect binding at /cgi/samlauth. The check fingerprints Citrix NetScaler ADC and Gateway from a NetScaler title on the public page, then sends an unsigned assertion with a wrong issuer and reads the rejectUnsignedAssertion config from the error page. It mints no session and needs no credentials, so a fleet advisory becomes an evidenced list for exposure management.

The safe oracle is the detection, not a version flag. NetScaler does not expose its build over the web, so a version-range read is best-effort. The oracle runs on every detected host and reads the config directly, which also covers hosts whose version could not be read. This page is a standalone check.

Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.

Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. Fingerprint each host as Citrix NetScaler ADC and Gateway from a NetScaler title on the public page, then attempt a best-effort build read from the root page.
3. Confirm every detected host with the safe oracle. An unsigned assertion with a wrong issuer is sent over the redirect binding, and the error page reveals the rejectUnsignedAssertion config without any session risk.
4. Collect the per-host rows and emit the summary counts.

Inputs

• Target list. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Set it in the targets node, or bind a text file. Point it at scope you are authorised to test. The check only sends read-only GET requests.

Outputs

• results.jsonl. One row per host: URL, whether Citrix NetScaler ADC and Gateway was detected, the best-effort build read, and the affected flag.
• confirms.jsonl. One row per detected host: the safe-oracle verdict and the rejectUnsignedAssertion config it revealed.
• summary.json. Counts across the list: targets, product hits, affected, and confirmed configs.

Integrations

• HTTP. Read-only GET to the product root and /cgi/samlauth. The confirm sends an unsigned assertion with a wrong issuer on every detected host. No login, no session, no exploit payload.

Sample output

The records below are illustrative and do not come from a real run. They show one Citrix NetScaler ADC and Gateway host whose build could not be read, one patched host, and one host that is not the product.

{"cve": "CVE-2026-19490", "total_targets": 3, "product_hits": 2, "affected": 0, "not_affected": 1, "version_unknown": 1, "errors": 1, "confirmed_vulnerable_config": 1, "confirmed_strict": 0, "saml_not_configured": 1}

FAQ

Which Citrix NetScaler ADC and Gateway builds does this flag?

14.1 before 14.1-73.32, 13.1 before 13.1-63.21, and 13.1 FIPS/NDcPP before 13.1-37.277. The version flag is best-effort, because NetScaler does not expose its build over the web. The safe oracle is the primary signal and does not depend on the version.

Why is the confirm a safe oracle instead of a full exploit?

The safe oracle sends an unsigned assertion with a deliberately wrong issuer. Both configs fail without creating a session, and the error page reveals the rejectUnsignedAssertion setting. It proves the vulnerable config with zero session risk, so it is safe to run against third-party targets.

Do the affected flag and vulnerable_config verdict mean the same thing?

No. The affected flag is a best-effort version-range classification when the build can be read. The primary vulnerable_config verdict comes from the safe oracle observing the rejectUnsignedAssertion setting. Neither signal proves exploitation.

Is this check safe on production?

Yes. It sends read-only GET requests. The confirm never logs in and never builds a session. It is the non-intrusive oracle from the CVE-2026-19490 research, not the exploit path.

Does the check need credentials?

No. It fingerprints the public page and reads the version the way an external scanner would. The confirm uses a wrong-issuer assertion, so it needs no IdP configuration from you.

Related workflows

• Citrix NetScaler RCE (CVE-2026-8452). Reach for it when the flag is the NetScaler heap overflow, not the SAML authentication bypass.
• PAN-OS GlobalProtect Auth Bypass (CVE-2026-0257). Reach for it when the edge box is GlobalProtect, not NetScaler.
• Full Network Port and Service Assessment. Reach for it when you still need to find which hosts speak the NetScaler login.