--- analysis: "A standard signature-based detection for this CVE might be evaded by minor\ \ adjustments in the exploit payload; this hunt instead looks for the behavioral\ \ aftermath\u2014successful, rare authentications and anomalous web patterns on\ \ vulnerable perimeter systems." blind_spots: - id: missing-appliance-telemetry question: Are the appliances configured to forward HTTP and authentication logs? requires: Syslog ingestion from NetScaler to hb_http_activity and hb_auth_signin risk: If logs are not centralized, the prevalence and behavioral queries will return zero results even if exploitation is occurring. stage: authentication-bypass-exploitation - id: ephemeral-auth-sessions question: Can the bypass establish a session without a recorded logon event? requires: hb_auth_signin session tracking risk: If the bypass occurs purely at the protocol level (e.g., SAML assertion injection) and the appliance does not log it as a standard 'logon', the auth prevalence query will miss it. stage: external-remote-access coverage: - stage: vulnerable-service-exposure status: covered steps: - identify-vulnerable-netscaler - stage: authentication-bypass-exploitation status: covered steps: - suspicious-web-access-patterns - stage: external-remote-access status: covered steps: - rare-auth-source-ips guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: NetScaler appliances are high-value perimeter targets; an unauthenticated bypass (CVE-2026-19490) allows direct internal access, making a negative result a critical security requirement. methodology: model-assisted trigger: intel-report hypothesis: An unauthenticated attacker has exploited CVE-2026-19490 on an internet-facing NetScaler appliance to bypass authentication and gain unauthorized remote access. labels: - hunt - attack.t1190 - attack.t1133 name: Citrix NetScaler Authentication Bypass and Exposure parameters: lookback_days: default: '14' description: Days of history to examine. type: number scope_hosts: default: [] description: List of hostnames or resource IDs for the identified vulnerable NetScaler appliances. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.rapid7.com/blog/post/etr-cve-2026-19490-critical-vulnerability-affecting-citrix-netscaler-adc-and-netscaler-gateway gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Focus on internet-exposed appliances first by cross-referencing vulnerability scans with external asset inventory. Use the hostnames from the vulnerability findings to populate the scope_hosts parameter for the behavioral queries. references: - name: "Rapid7 \u2014 CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler\ \ ADC and NetScaler Gateway" url: https://www.rapid7.com/blog/post/etr-cve-2026-19490-critical-vulnerability-affecting-citrix-netscaler-adc-and-netscaler-gateway related: - hunt: citrix-netscaler-shell-exploitation reason: This hunt focuses on the authentication bypass; post-exploitation shell activity on the underlying Linux OS requires different telemetry surfaces. relation: out-of-scope-alternative scenario: stages: - name: Exposed Vulnerable NetScaler Service observables: - NetScaler ADC versions prior to 14.1-73.32 - NetScaler Gateway versions prior to 13.1-63.21 - NetScaler ADC FIPS - NetScaler ADC NDcPP slug: vulnerable-service-exposure tactic: initial-access techniques: - T1190 - name: NetScaler Authentication Bypass observables: - Unauthenticated remote network access - SAML action configuration (add authentication samlAction) - VPN vserver configuration (add vpn vserver) - Auth vserver configuration (add authentication vserver) slug: authentication-bypass-exploitation tactic: initial-access techniques: - T1190 - name: Unauthorized External Remote Access observables: - Successful gateway login without valid credential record - Bypassed authentication session via SAML slug: external-remote-access tactic: initial-access techniques: - T1133 summary: Attackers can bypass authentication on Citrix NetScaler ADC and NetScaler Gateway appliances via CVE-2026-19490, a critical vulnerability affecting systems configured with SAML or VPN virtual servers. This allows unauthenticated remote access to the perimeter device, providing a foothold for initial access into the corporate network. severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent identity: category: identity name: Identity / sign-in telemetry telemetry: - identity web: category: siem name: Web server / proxy logs telemetry: - network tlp: clear type: investigation --- # Citrix NetScaler Authentication Bypass and Exposure This hunt identifies Citrix NetScaler ADC and Gateway appliances vulnerable to CVE-2026-19490 and evaluates signs of exploitation. It first scopes the estate using vulnerability findings for the specific CVE. It then analyzes authentication patterns and HTTP traffic targeting sensitive SAML and VPN endpoints on those systems to identify rare source IPs and anomalous access that indicate a successful authentication bypass. ## identify-vulnerable-netscaler Find systems with active, unresolved findings for CVE-2026-19490. ```sqlite target=endpoint role=scoping ~~~yaml expected: Rows identify specific vulnerable appliances. No rows means no confirmed vulnerabilities are present in the vulnerability management data. reads: - device_uid - resource_uid - severity - collected_at silence: not_evidence_of_absence source: hb_vulnerability_finding verified: dry-run verified_at: '2026-09-28' ~~~ SELECT device_uid, resource_uid, severity, collected_at FROM hb_vulnerability_finding WHERE cve_uid = 'CVE-2026-19490' AND status = 'unresolved' ``` ## rare-auth-source-ips Identify rare external IP addresses successfully authenticating to NetScaler services, which may indicate bypassed authentication. ```sqlite target=identity role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Source IPs that have only successfully logged into one or two appliances stand out from regular corporate VPN users. prevalence: by: device_hostname key: - src_endpoint_ip rare_below: 3 reads: - src_endpoint_ip - device_hostname - time - status_id - metadata_product - provider silence: not_evidence_of_absence source: hb_auth_signin verified: dry-run verified_at: '2026-09-28' ~~~ SELECT src_endpoint_ip, COUNT(DISTINCT device_hostname) AS host_count, COUNT(*) AS login_events, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_auth_signin WHERE (LOWER(metadata_product) LIKE '%citrix%' OR LOWER(provider) LIKE '%citrix%') AND status_id = 1 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY src_endpoint_ip HAVING host_count <= 2 ORDER BY host_count ASC, login_events DESC ``` ## suspicious-web-access-patterns Identify unusual HTTP request patterns targeting sensitive NetScaler authentication and gateway paths. ```sqlite target=web role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: Access to SAML or VPN endpoints from IPs identified as rare in the prevalence step, or requests that return successful status codes without typical precursor sessions. reads: - device_hostname - url_path - url_query - src_endpoint_ip - user_agent - status_code - time silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-09-28' ~~~ SELECT device_hostname, url_path, url_query, src_endpoint_ip, user_agent, status_code, time FROM hb_http_activity WHERE (LOWER(url_path) LIKE '%/logon/%' OR LOWER(url_path) LIKE '%/saml/%' OR LOWER(url_path) LIKE '%/vpn/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY time DESC ``` ## agent-triage ```agent target=hunter cite: required context: - identify-vulnerable-netscaler - rare-auth-source-ips - suspicious-web-access-patterns max_iterations: 5 objective: Determine if CVE-2026-19490 has been exploited by evaluating anomalous access to vulnerable NetScaler appliances. success_criteria: A clear verdict of malicious, suspicious, or benign for each host in scope. tools: - endpoint - identity - web ``` ## exploitation-decision if~: "the agent-triage verdict is malicious or suspicious for at least one host" (confidence: high, judge=hunter) then: → remediation-task indeterminate: → remediation-task unavailable: → remediation-task (blind_spot: missing-appliance-telemetry) else: → close-out-task ## remediation-task ```manual target=analyst 1. Confirm that all NetScaler appliances identified in the scoping step are updated to at least the fixed versions (14.1-73.32 or 13.1-63.21). 2. For hosts with malicious activity, verify if SAML configurations were tampered with. 3. Review internal access logs from the compromised appliance IPs to determine lateral movement. ``` → close-out-task ## close-out-task ```manual target=analyst Document the resolution of the vulnerability findings. Ensure any suspicious source IPs identified are added to watchlists for future monitoring. ``` → end