Exploitation Expected for Critical Authentication Bypass Patched in Citrix NetScaler

Summary

Citrix released patches for a critical authentication bypass vulnerability (CVE-2026-19490, CVSS 9.3) in NetScaler ADC and NetScaler Gateway that allows remote, unauthenticated attackers to bypass authentication without user interaction. The flaw affects multiple product versions and impacts systems configured as gateways or AAA virtual servers. Rapid7 expects rapid exploitation given NetScaler's typical deployment in enterprise DMZs and perimeter networks, urging organizations to patch on an emergency basis.

Full text

Citrix on Wednesday announced patches for two vulnerabilities in NetScaler ADC and NetScaler Gateway, including a critical-severity flaw. The critical bug, tracked as CVE-2026-19490 (CVSS score of 9.3), is described as an authentication bypass using an alternative path, and impacts NetScaler appliances configured as a gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server. It can be exploited by remote, unauthenticated attackers without user interaction, cybersecurity firm Rapid7 says. Per Citrix’s advisory, the security defect impacts NetScaler ADC and NetScaler Gateway versions 14.1-43.56 or later, 14.1-66.68-FIPS or later, 14.1-43.55 or earlier, 13.1-61.28 or later, 13.1-61.27 or earlier, and 13.1 FIPS. NetScaler ADC and Gateway versions 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS, and 13.1-FIPS and 13.1-NDcPP 13.1-37.277 contain fixes for this flaw and for CVE-2026-19489, a high-severity memory overflow issue that could lead to unexpected behavior or denial-of-service (DoS) if SIP ALG is enabled at an LSN group configuration. “Secure Private Access Hybrid deployments using NetScaler instances are also affected by the vulnerabilities. Customers need to upgrade these NetScaler instances to the recommended NetScaler builds to address the vulnerabilities,” Citrix says.Advertisement. Scroll to continue reading. According to Rapid7, there are no indicators that threat actors are exploiting the authentication bypass issue, but NetScaler’s critical role within enterprise systems makes it an attractive target for hackers. “NetScaler ADC and NetScaler Gateway are widely deployed enterprise networking products commonly positioned at or near the network perimeter. NetScaler ADC provides application delivery, traffic management, load balancing, SSL/TLS offloading, and application security capabilities, while NetScaler Gateway provides secure remote access and VPN functionality,” the cybersecurity firm notes. Rapid7 expects threat actors to exploit the critical bug shortly, given that NetScaler appliances are typically deployed in enterprise DMZs and are publicly accessible. “Organizations should prioritize patching affected systems on an emergency basis, since Citrix products are high-value targets that tend to quickly see exploitation in the wild,” the company says. Related: Critical GitLab Flaw Exploited Shortly After Disclosure Related: Citrix Patches NetScaler Vulnerabilities, Including New ‘HTTP/2 Bomb’ Attack Related: Exploitation of Fresh Citrix NetScaler Vulnerability Begins Related: 943 Patches Rolled Out With Oracle’s August 2026 Security Update Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Chrome, Firefox Updates Patch Dozens of VulnerabilitiesXpander Raises $7.5 Million for AI Management and Governance300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin FlawHeights Finance Data Breach Impacts at Least 1.2 Million IndividualsGitLab Patches Critical Code Injection VulnerabilityDozens of WebKit Vulnerabilities Patched With Fresh macOS, iOS Security Updates680,000 Impacted by French Tax Authority Data Breach40,000 Impacted by SafePal Data Breach Latest News Critical GitLab Flaw Exploited Shortly After DisclosureHackers Using AI to Target Siemens PLCs in Critical US SectorsVirtual Event Today: CodeSecCon – Secure Your Code and ApplicationsPrevalent AI Raises $22 Million to Expand Data Fabric PlatformUS Charges 17 Iranian Hackers, Offers $10 Million Rewards for 5 of ThemCl0p Ransomware Group Names Over 40 Victims of PTC Windchill CampaignCISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple Vulnerabilities943 Patches Rolled Out With Oracle’s August 2026 Security Update Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveDali Rajic is joining OpenAI as Chief Revenue Officer.Erika Dean has been appointed Chief Information Security Officer at Tricentis.C1 has named Jeff St. Clair Chief Revenue Officer.More People On The MoveExpert Insights The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It Organizations are rushing to implement AI without fully grasping where its legal protections begin and end. (Steve Durbin) Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2026-19490
• cve — CVE-2026-19489

Entities