Bishop Fox maps NetScaler CVE-2026-19490 from a safe patch-state probe to root, with the decoded length as the payload

Sources: Bishop Fox writeup, HN submission
Summary: The writeup, dated 2026-09-10, moves from a probe that reveals patch state without harm to root on the appliance, using the decoded length of the request as the payload. One outcome needs no particular configuration: a crash-length POST restarts the packet engine and drops all traffic through the appliance for roughly 45 seconds. Fixed builds are 13.1-63.21 and 14.1-73.32 or later, and 12.1 and 13.0 get no fix. The post is weaponization of a Citrix advisory published 2026-08-19 and makes no exploitation claim of its own.
Why it matters: NetScaler ADC and Gateway sit internet-facing by design, and both nodes of an HA pair need patching because an unpatched secondary is exposed the moment it takes over.
Follow-up: Whether Citrix publishes a fix for the 12.1 and 13.0 branches.