CVE-2026-19490

Sentinel/Defender KQL

DeviceNetworkEvents
| where ActionType == "Authentication Bypass Attempt"
| where InitiatingProcessFileName contains "NetScaler"
| summarize count() by DeviceName, RemoteIP, InitiatingProcessFileName, ActionType
| where count_ > 5 // Adjust threshold as needed for your environment

Splunk SPL

sourcetype=citrix:netscaler (authentication_bypass OR "authentication bypass") | stats count by host, src_ip | where count > 5

Sigma

title: Citrix NetScaler Authentication Bypass Attempt
status: experimental
description: Detects potential authentication bypass attempts on Citrix NetScaler ADC and NetScaler Gateway.
references:
  - https://www.securityweek.com/critical-netscaler-vulnerability-exploited-in-attacks/
logsource:
  category: network_traffic
  product: citrix_netscaler
detection:
  selection:
    EventID: "Authentication Bypass"
    Image|endswith: "NetScaler.exe"
  condition: selection
fields:
  - InitiatingProcessFileName
  - RemoteIP
  - DeviceName
level: high

Elastic ES|QL

from network_traffic
| where event.action == "authentication bypass attempt"
| where process.executable.name : "NetScaler*"
| stats count() by host.name, source.ip, process.executable.name, event.action
| where count > 5