Advisory · CVE-2026-19490
NetScaler auth bypass lets attackers skip the login gate
An authentication bypass in NetScaler ADC and Gateway lets an unauthenticated remote attacker skip authentication on Gateway and AAA deployments. Fixed in builds 14.1-73.32 and 13.1-63.21; CISA confirms active exploitation.
- Vendor
- Citrix
- Product
- NetScaler
- Identifier / CWE
- CVE-2026-19490
CWE-288 - Action timing
- Sep 30, 2026
Explain it like I’m five
A building has a side door for deliveries that skips the front-desk sign-in. Anyone who finds it can walk in and ride the elevators without ever showing a badge.
- 01Internet-facing appliance
The attacker reaches a NetScaler ADC or Gateway configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
- 02Alternate path
The request takes an alternate authentication path that does not enforce the normal login checks.
- 03Auth bypassed
The unauthenticated attacker gains unauthorized access without credentials or user interaction.
- 04Services reached
The attacker can reach the VPN, proxy, and AAA-protected services sitting behind the appliance.
What happened
Citrix security bulletin CTX696939, published August 19, 2026, documents an authentication bypass using an alternate path or channel (CWE-288) in NetScaler ADC and NetScaler Gateway. When the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server, an unauthenticated remote attacker can bypass authentication and gain unauthorized access. Citrix rates it CVSS 4.0 9.3; NVD rates the same issue CVSS 3.1 9.8. A public proof of concept appeared on September 2, and exploitation attempts matching it were observed from September 3 onward. There is no workaround. Fixed builds are 14.1-73.32 and 13.1-63.21, plus corresponding FIPS and NDcPP builds. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 9, 2026.
What to do
- Upgrade customer-managed NetScaler ADC and Gateway appliances to 14.1-73.32, 13.1-63.21, or the matching FIPS/NDcPP build; Citrix-managed cloud services were patched by the vendor.
- After upgrading, terminate all existing AAA and ICA sessions so sessions established before the patch cannot be replayed.
- Hunt for post-exploitation artifacts on internet-facing appliances, including unexpected web shells and OS command execution from the NetScaler web process, and review Gateway and AAA logs since mid-August.
- Treat any internet-facing Gateway or AAA deployment that was unpatched during the exposure window as potentially compromised until forensic review proves otherwise.
Management note
NetScaler gateways sit at the network edge, directly between the internet and internal applications, so an authentication bypass there skips the front door entirely. A working exploit circulated within two weeks of disclosure and CISA has confirmed active exploitation. Because there is no workaround, the only question is how fast the upgrade and session reset happen.