Listen to this Post
CVE-2026-19490 is a critical authentication bypass vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway appliances. The flaw resides in the SAML HTTP‑Redirect binding handler at the `/cgi/samlauth` endpoint and allows an unauthenticated remote attacker to forge a valid session without any user interaction. The vulnerability is classified as CWE‑288 (Authentication Bypass Using an Alternate Path) and carries a CVSS v4.0 base score of 9.3 (Critical).
The root cause lies in two simultaneous coding errors within the `nsppe` packet engine, the component that processes SAML assertions. First, when the HTTP‑Redirect binding is used (as opposed to the POST binding), the SAML response parser is invoked with the `strict` flag cleared. In the disassembled binary, the redirect path sets `r8d` to `0x0` before calling the parser, whereas the POST path passes a non‑zero value. This means that the redirect handler accepts malformed or unsigned assertions that would be rejected by the POST handler.
Second, the gate that checks for unsigned assertions misinterprets the default configuration value. The configuration word for `rejectUnsignedAssertion` is compared against the value `2` (which means “ON” – the default setting) and jumps to the accept path when it sees 2. Only the value `3` (“STRICT”) would trigger a denial. As a result, even on a box with the default “reject unsigned” setting, an unsigned assertion presented via the redirect binding is accepted without any signature verification, digest check, or cryptographic validation.
An attacker can exploit this by crafting a SAML Response that contains no `/cgi/samlauth. The parser then extracts the attacker‑supplied Issuer, Audience, Recipient/Destination, and `NameID` fields, and proceeds to construct a session cookie (NSC_AAAC / NSC_TASS) without ever verifying the assertion’s authenticity.
The precondition for exploitation is that the appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server with a SAML action bound. This covers the majority of production deployments that use SAML single sign‑on. The POST binding is not vulnerable because it passes the strict flag to the parser and correctly rejects unsigned input.
Proof‑of‑concept code has been publicly released, and active exploitation attempts have been observed in the wild shortly after disclosure. The vendor released fixed builds on August 19, 2026, addressing the issue in versions 14.1‑73.32 and 13.1‑63.21.
DailyCVE Form:
Platform: NetScaler ADC/Gateway
Version: 14.1<73.32, 13.1<63.21
Vulnerability: Authentication Bypass (CWE‑288)
Severity: Critical (CVSS 9.3)
Date: 2026‑08‑19
Prediction: Patch available 2026‑08‑19
What Undercode Say:
Analytics:
- CVSS v4.0 Score: 9.3 (Critical) – Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: None
- EPSS Score: 0.00345 (low probability of exploitation in the wild at disclosure, but PoC and active attempts have since been reported)
- Affected deployments: All NetScaler ADC/Gateway versions 14.1 before build 73.32 and 13.1 before build 63.21, including FIPS and NDcPP variants
- Precondition: Appliance must be configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver with SAML action
- Public PoC available on GitHub (TarPeg007/CVE‑2026‑19490) with active exploitation observed
Bash Commands & Codes (for detection and validation):
Check if the /cgi/samlauth endpoint is reachable and processes SAMLResponse via GET python3 poc.py https://vpn.target.com --check-only Non-intrusive config probe – sends an unsigned assertion with a wrong issuer Returns "Malformed Assertion" → not vulnerable (STRICT mode) Returns "issuer/policy error" → vulnerable (default config) python3 poc.py https://vpn.target.com --safe-oracle Full exploitation (authorized targets only) – forge a session as a given NameID python3 poc.py https://vpn.target.com --mint --name-id [email protected] Manual curl example for a vulnerable endpoint (educational purposes) Construct a DEFLATE+base64 SAMLResponse without signature and send it curl -i "https://vpn.target.com/cgi/samlauth?SAMLResponse=<b64_encoded>&RelayState=<ctx>"
Detection using grep on the nsppe binary (for forensic analysis):
Check if the strict flag is cleared in the redirect handler objdump -d -M intel --start-address=0xb7f532 --stop-address=0xb7f558 nsppe-14.1-73.30 | grep "mov r8d,0x0" Verify the unsigned-assertion gate miscomparison objdump -d -M intel --start-address=0xb7ee3b --stop-address=0xb7ee41 nsppe-14.1-73.30
Exploit (Educational Purposes!):
- Identify a target that is configured as a NetScaler Gateway or AAA vserver with SAML action enabled.
- Obtain the SAML configuration parameters (IdP Entity ID, SP Entity ID, ACS URL, and optionally an `InResponseTo` value) – these can often be gleaned from the pre‑auth login redirect which contains a `SAMLRequest` in the Location header.
3. Craft a SAML Response assertion with:
- No `
– `Issuer` set to the IdP entity ID.
– `Audience` set to the SP entity ID. Recipient/Destinationset to the ACS URL.
– `NameID` set to the desired user identity.
4. DEFLATE‑compress the XML and base64‑encode the result.
- Send a GET request to `/cgi/samlauth` with the `SAMLResponse` parameter containing the encoded payload and an optional
RelayState. - The vulnerable parser accepts the assertion, bypasses signature verification, and issues a valid session cookie (
NSC_AAAC/NSC_TASS). - Use the forged cookie to access protected resources behind the Gateway as the impersonated user.
Protection:
- Upgrade immediately to the fixed builds: NetScaler ADC/Gateway 14.1‑73.32 or 13.1‑63.21 (or any later release).
- If immediate patching is not possible, disable SAML HTTP‑Redirect binding on Gateway/AAA vservers and enforce the use of POST binding only (though this is not an official workaround and may break functionality).
- Monitor logs for unusual GET requests to `/cgi/samlauth` with a `SAMLResponse` parameter, especially those that do not originate from your legitimate IdP.
- Restrict network access to the management and Gateway interfaces to trusted IP ranges where feasible.
- Apply the vendor security bulletin CTX696939 which contains the official fix.
Impact:
- Authentication Bypass: An unauthenticated remote attacker can bypass all authentication controls and impersonate any user by forging a SAML assertion.
- Session Forgery: The attacker receives a valid `NSC_AAAC` / `NSC_TASS` session cookie, granting access to VPN, ICA Proxy, CVPN, RDP Proxy, and other protected resources.
- Confidentiality & Integrity Breach: With a forged session, the attacker can read, modify, or delete sensitive data within the internal network, and potentially pivot to other systems.
- Availability Impact: Although the CVSS vector rates availability as high (VA:H), the primary impact is on confidentiality and integrity; however, a successful compromise could lead to denial of service through malicious actions.
- Widespread Exposure: Given that many enterprises deploy NetScaler as their external access gateway, this vulnerability poses a significant risk to a large number of organisations worldwide. Active exploitation has already been reported, making immediate patching critical.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
