NetScaler CVE-2026-19490: three distinct CVEs

On 19 August 2026, Cloud Software Group published bulletin CTX696939 for two NetScaler ADC and NetScaler Gateway vulnerabilities: CVE (1) CVE-2026-19489, a memory overflow leading to denial of service, and CVE-2026-19490, an authentication bypass. It is the second that draws attention. It rates 9.3 on the CVSS (2) 4.0 scale and falls under CWE (3) 288, authentication bypass using an alternate path or channel.

On 9 September, the US Cybersecurity and Infrastructure Security Agency, CISA (4), added this CVE to its Known Exploited Vulnerabilities catalog, KEV (5), on the strength of observed exploitation. The entry carries a remediation deadline of 12 September, that is three days for US federal civilian agencies under directive BOD (6) 26-04, and a forensic triage requirement. CISA names the flaw “Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability”.

On 26 September, offensive research firm watchTowr issued an alert of a different nature: two pre-authentication code executions on NetScaler, distinct from the 19490, exploited in the wild while no patch was yet available. The link between these two events is the crux of this article. They share the product, the timeframe and the word NetScaler; they share neither the flaw, nor the mechanism, nor the fix.

The bulletin wording stays terse: a vulnerability affecting ADC and Gateway on branches 14.1 up to 73.32 and 13.1 up to 63.21. The technical analysis published in late September by an independent researcher, consistent with the bulletin’s preconditions, spells out the mechanism: the flaw lives in nsppe, the packet processing engine, on the SAML (7) HTTP-Redirect binding handler, reachable through a GET request to /cgi/samlauth.

Two defects combine. First, the Redirect path calls the SAML assertion parser with the strict flag cleared, whereas the POST path, the one browsers actually use, leaves it set: this is the alternate path in the CWE-288 sense, the same request surface served by a weaker parser invocation. Second, the gate meant to reject unsigned assertions reads the default configuration value as an allow. An unsigned assertion, handed to the Redirect binding, is therefore parsed and accepted, and the appliance builds a session from attacker-supplied fields. No signature check occurs on that route. A single GET request, carrying an unsigned SAML response, is enough to forge a session under the chosen identity.

The preconditions matter, and the bulletin details them per build. From versions 14.1-43.56 and 13.1-61.28 onward, the flaw is reachable only with a SAML action configured and bound to a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or to an AAA (8) virtual server, which corresponds to the usual SAML SSO setup. Earlier builds register the route on the virtual server alone. An administrator checks exposure by inspecting the configuration for the strings add authentication samlAction and add authentication vserver or add vpn vserver. There is no workaround: the bulletin offers only the update.

The same vulnerability carries three different ratings depending on the reference consulted, and the gap deserves a careful reading rather than a hasty conclusion. NetScaler, as the numbering authority, publishes a CVSS 4.0 of 9.3. The NVD (9) adds a CVSS 3.1 of 9.8, a mechanically higher value because the 3.1 metric does not separate the impact on the vulnerable system from the impact beyond it, unlike 4.0 which scores the subsequent-system impacts here as Low. The Russian BDU database shows a CVSS 2.0 and a CVSS 3.1 of 10.0. Three scales, three readings of one defect: it is the vendor’s 4.0, at 9.3, that stands as the reference for qualification.

CISA’s SSVC (10) settles the operational question where CVSS stays theoretical: exploitation active, automatable, total technical impact. The EPSS (11) recorded on 27 September places the near-term exploitation probability at 7.01 %, at the 94th percentile. The flaw is vendor-confirmed, exploited, and a public repository documents the mechanism with a non-intrusive probe letting a defender test its own configuration.

Fig. 1: ratings of CVE-2026-19490 by source, read off the rendered pages on 27 September 2026. The vendor’s 4.0, at 9.3, is the reference value.

This is the point watchTowr insisted on, and it must be relayed without distortion. The telemetry the firm analysed, corroborated by several hunting clusters, shows that the attacks under way in late September do not rely on CVE-2026-19490. Adversaries are exploiting a pair of then-undocumented flaws: a heap overflow in nsppe during the parsing of fragmented HTTP/2 frames, chained to a control-flow hijack that moves from memory corruption to an interactive root shell. CVE-2026-19490 is an authentication bypass; these zero-days are remote code executions, RCE (12). The first lets an attacker in without credentials; the latter take control of the appliance.

One detail worsens the confusion: the appliances on 14.1-73.32 and 13.1-63.21, precisely the builds that fixed the 19490 in August, fall within the range affected by these new zero-days. Fixing the August flaw does not protect against the September ones. At disclosure time no patch was available, and the guidance relayed by the community and then by several CERTs came down to isolating or shutting off the exposed gateways.

Citrix has since published the fixes in bulletin CTX697096, which addresses eight flaws in total. The two exploited zero-days there receive the identifiers CVE-2026-88771, an improper input validation leading to unauthenticated command execution, and CVE-2026-88772, a memory overflow exploitable when DTLS is enabled, both rated 9.5 in CVSS 4.0. The fixed builds are 14.1-73.37 and 13.1-64.23.

A Suricata rule published on the Rulezet platform on 27 September illustrates the risk of this confusion. It is labelled CVE-2026-19490, but its description and its source, the watchTowr analysis relayed by the sh3llc0d3 blog, actually tie it to the exploitation of the RCE zero-days, not the SAML bypass. Here is its content:

alert tcp any any -> $NETSCALER_IPS 443 (msg:"SH3LLC0D3 - Exploit Attempt Citrix NetScaler Pre-Auth RCE Zero-Day (watchTowr Advisory)"; flow:to_server,established; content:"|16 03|"; depth:2; content:"/vpn/../"; fast_pattern; pcre:"/\x00{8,}[^\x00]{128,}/s"; classtype:attempted-admin; sid:202608901; rev:1;)

The rule inspects inbound traffic to port 443 on NetScaler appliances. The first pattern, |16 03| at the start of the stream, matches the TLS record type byte (handshake, 0x16) followed by the start of the version: the rule therefore fires on the opening of an encrypted session. The second pattern, /vpn/../, targets a directory-traversal attempt on the VPN path, set as fast_pattern to serve as a quick filter. The regular expression looks for a run of at least eight null bytes followed by at least 128 non-null bytes, the signature of padding then a payload, consistent with the exploitation of a memory overflow.

The rule’s logic therefore does target the RCE chain described by watchTowr, with its binary payloads against the packet engine, and not the SAML bypass of the 19490, which goes through a GET request to /cgi/samlauth carrying a cleartext assertion, with no traversal and no null bytes. The rule is useful; its labelling is misleading. An analyst who deploys it believing it covers the 19490 is in fact protected against something else and leaves the SAML surface without dedicated detection. Its quality score on the platform, 48 out of 100, reflects the missing ATT&CK mapping and linkage metadata: the CVE number is not authoritative.

For the 19490 itself, the relevant detection is elsewhere: spotting requests to /cgi/samlauth carrying a SAMLResponse parameter over the GET method, which is rare since browsers POST their SAML responses, and watching the error-page differential between a STRICT configuration and a default one, as documented by the public PoC (13).

Three scopes partly overlap on the same product. The distinction drives the response: the CVE number identifies a precise defect, not a product or a period.

Fig. 2: three scopes to handle separately on NetScaler, with the key flaw or flaws of each. Updating to the September builds also covers the 19490; the reverse is not true.

• Install without delay the builds 14.1-73.37 and 13.1-64.23 from bulletin CTX697096, which cover the September zero-days and include the August fixes.
• On appliances not yet handled for the 19490, check for a SAML action bound to a Gateway or to an AAA virtual server, and cut internet exposure of the Gateway interfaces during the update.
• Deploy detection specific to each flaw, without trusting the CVE label a public rule carries: for the 19490, watch GET requests to /cgi/samlauth carrying a SAMLResponse parameter.

The facts of publication, versions and catalog listing come from primary sources. The circumstances of exploitation and the detailed mechanism come from vendors and researchers, cross-checked against one another.

Fig. 3: status of each element carried in the article, by the number and nature of the sources that establish it.

1. CVE (1): Common Vulnerabilities and Exposures, a unique public identifier for a vulnerability.
2. CVSS (2): Common Vulnerability Scoring System, a standardised framework for rating the severity of a vulnerability.
3. CWE (3): Common Weakness Enumeration, a classification of software weakness types.
4. CISA (4): Cybersecurity and Infrastructure Security Agency, the US cybersecurity and infrastructure security agency.
5. KEV (5): Known Exploited Vulnerabilities, the catalog kept by CISA of vulnerabilities for which exploitation has been observed.
6. BOD (6): Binding Operational Directive, a binding CISA directive for US federal civilian agencies; BOD 26-04 sets remediation timelines by risk.
7. SAML (7): Security Assertion Markup Language, a standard for exchanging authentication assertions between an identity provider and a service, here for gateway SSO.
8. AAA (8): NetScaler authentication, authorization and auditing virtual server, one of the roles that make the flaw reachable.
9. NVD (9): National Vulnerability Database, the US vulnerability database kept by NIST, which publishes its own rating.
10. SSVC (10): Stakeholder-Specific Vulnerability Categorization, CISA’s decision method based on exploitation, automatability and technical impact.
11. EPSS (11): Exploit Prediction Scoring System, the estimated near-term probability that a vulnerability will be exploited.
12. RCE (12): Remote Code Execution, running code remotely on the targeted system.
13. PoC (13): Proof of Concept, demonstration code establishing that a flaw is exploitable.

1. Cloud Software Group, Bulletin CTX696939, NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19489 and CVE-2026-19490, 19 August 2026. support.citrix.com
2. CISA, Known Exploited Vulnerabilities Catalog, entry CVE-2026-19490, 9 September 2026. cisa.gov
3. Vulnerability-Lookup (CIRCL), CVE-2026-19490 entry: CVSS, SSVC, EPSS, KEV, affected products, accessed 27 September 2026. vulnerability.circl.lu
4. NVD, CVE-2026-19490, accessed 27 September 2026. nvd.nist.gov
5. CERT-FR, CERTFR-2026-AVI-1059, Multiple vulnerabilities in Citrix products, 20 August 2026. cert.ssi.gouv.fr
6. watchTowr, advisory on the exploited NetScaler zero-days, 26 September 2026. x.com/watchtowrcyber
7. The Hacker News, Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation, 27 September 2026. thehackernews.com
8. sh3llc0d3, Inside the NetScaler Zero-Day Siege: Chained Pre-Auth RCEs Weaponized in the Wild, 27 September 2026. sh3llc0d3.com
9. Cyber Kendra, Citrix Patches Two Exploited NetScaler RCE Zero-Days, CVE-2026-88771 and CVE-2026-88772, bulletin CTX697096, 27 September 2026. cyberkendra.com
10. Rulezet, Suricata rule SH3LLC0D3, sid 202608901, 27 September 2026. rulezet.org
11. TarPeg007, CVE-2026-19490, root cause analysis and PoC, GitHub, September 2026. github.com/TarPeg007