---
title: "NetScaler SAML Auth Bypass (CVE-2026-19490)"
canonical: https://trickest.com/library/citrix-netscaler-saml-auth-bypass-check-cve-2026-19490
description: "Confirm CVE-2026-19490 vulnerable SAML configuration with a safe oracle, then review NetScaler title fingerprints and best-effort version rows."
---

# NetScaler SAML Auth Bypass (CVE-2026-19490)

## Overview

A version-only scan can miss CVE-2026-19490 when a NetScaler build is unreadable. This workflow confirms the vulnerable SAML configuration with a non-intrusive safe oracle and returns the observed config for each detected host. CVE-2026-19490 is an unauthenticated authentication bypass in the SAML HTTP-Redirect binding at `/cgi/samlauth`. The check fingerprints Citrix NetScaler ADC and Gateway from a NetScaler title on the public page, then sends an unsigned assertion with a wrong issuer and reads the rejectUnsignedAssertion config from the error page. It mints no session and needs no credentials, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management).

The safe oracle is the detection, not a version flag. NetScaler does not expose its build over the web, so a version-range read is best-effort. The oracle runs on every detected host and reads the config directly, which also covers hosts whose version could not be read. This page is a standalone check.

Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. Fingerprint each host as Citrix NetScaler ADC and Gateway from a NetScaler title on the public page, then attempt a best-effort build read from the root page.
3. Confirm every detected host with the safe oracle. An unsigned assertion with a wrong issuer is sent over the redirect binding, and the error page reveals the rejectUnsignedAssertion config without any session risk.
4. Collect the per-host rows and emit the summary counts.

## Inputs

- **Target list.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Set it in the targets node, or bind a text file. Point it at scope you are authorised to test. The check only sends read-only GET requests.

## Outputs

- **results.jsonl.** One row per host: URL, whether Citrix NetScaler ADC and Gateway was detected, the best-effort build read, and the affected flag.
- **confirms.jsonl.** One row per detected host: the safe-oracle verdict and the rejectUnsignedAssertion config it revealed.
- **summary.json.** Counts across the list: targets, product hits, affected, and confirmed configs.

## Integrations

- HTTP. Read-only GET to the product root and `/cgi/samlauth`. The confirm sends an unsigned assertion with a wrong issuer on every detected host. No login, no session, no exploit payload.

## Sample output

The records below are illustrative and do not come from a real run. They show one Citrix NetScaler ADC and Gateway host whose build could not be read, one patched host, and one host that is not the product.

```jsonl
{"target_url": "https://vpn-a.example.com", "product_detected": true, "version": null, "affected": null, "error": "version_unknown"}
{"target_url": "https://vpn-b.example.org", "product_detected": true, "version": "14.1-73.32", "affected": false, "error": null}
{"target_url": "https://shop.example.net", "product_detected": false, "version": null, "affected": null, "error": "not_product"}
```

```jsonl
{"target_url": "https://vpn-a.example.com", "saml_endpoint": true, "redirect_binding": "active", "verdict": "vulnerable_config", "config": "default", "error": null}
{"target_url": "https://vpn-b.example.org", "saml_endpoint": false, "redirect_binding": null, "verdict": null, "config": null, "error": "saml_not_configured"}
```

```json
{"cve": "CVE-2026-19490", "total_targets": 3, "product_hits": 2, "affected": 0, "not_affected": 1, "version_unknown": 1, "errors": 1, "confirmed_vulnerable_config": 1, "confirmed_strict": 0, "saml_not_configured": 1}
```

## FAQ

### Which Citrix NetScaler ADC and Gateway builds does this flag?

14.1 before 14.1-73.32, 13.1 before 13.1-63.21, and 13.1 FIPS/NDcPP before 13.1-37.277. The version flag is best-effort, because NetScaler does not expose its build over the web. The safe oracle is the primary signal and does not depend on the version.

### Why is the confirm a safe oracle instead of a full exploit?

The safe oracle sends an unsigned assertion with a deliberately wrong issuer. Both configs fail without creating a session, and the error page reveals the rejectUnsignedAssertion setting. It proves the vulnerable config with zero session risk, so it is safe to run against third-party targets.

### Do the affected flag and vulnerable_config verdict mean the same thing?

No. The `affected` flag is a best-effort version-range classification when the build can be read. The primary `vulnerable_config` verdict comes from the safe oracle observing the rejectUnsignedAssertion setting. Neither signal proves exploitation.

### Is this check safe on production?

Yes. It sends read-only GET requests. The confirm never logs in and never builds a session. It is the non-intrusive oracle from the CVE-2026-19490 research, not the exploit path.

### Does the check need credentials?

No. It fingerprints the public page and reads the version the way an external scanner would. The confirm uses a wrong-issuer assertion, so it needs no IdP configuration from you.

## Related workflows

- [Citrix NetScaler RCE (CVE-2026-8452)](/library/citrix-netscaler-rce-check-cve-2026-8452). Reach for it when the flag is the NetScaler heap overflow, not the SAML authentication bypass.
- [PAN-OS GlobalProtect Auth Bypass (CVE-2026-0257)](/library/pan-os-globalprotect-auth-bypass-check-cve-2026-0257). Reach for it when the edge box is GlobalProtect, not NetScaler.
- [Full Network Port and Service Assessment](/library/full-network-port-and-service-assessment). Reach for it when you still need to find which hosts speak the NetScaler login.

---
_Markdown source of https://trickest.com/library/citrix-netscaler-saml-auth-bypass-check-cve-2026-19490._