CVE-2026-19490 is an authentication bypass in Citrix NetScaler ADC and Gateway, rated CVSS 9.3. It works by an alternative path, requires no credentials and no user interaction, and can be triggered remotely.
A second flaw, CVE-2026-19489, a high-severity memory overflow affecting SIP ALG configurations, was patched at the same time.
No exploitation has been observed yet.
Which boxes
Only appliances in particular roles are affected, and they are the roles NetScaler is usually bought for:
- Configured as a gateway — SSL VPN, ICA Proxy, CVPN, RDP Proxy
- AAA virtual servers
In other words: the configurations whose entire job is authenticating people from the internet.
Fixed in
| Branch | Upgrade to |
|---|---|
| 14.1 | 14.1-73.32 |
| 13.1 | 13.1-63.21 |
| 14.1 FIPS | 14.1-73.32 FIPS |
| 13.1 FIPS / NDcPP | 13.1-37.277 |
Check the exact build rather than the branch. Citrix's affected list spans versions both above and below specific point releases, which is the kind of thing that gets misread at 6pm on a Friday.
Why "not exploited yet" is not the useful sentence
Rapid7's guidance is to patch on an emergency basis regardless, on the grounds that Citrix products are high-value targets that tend to see exploitation quickly.
That is not caution for its own sake. It follows from where the device sits. A NetScaler in gateway mode is, by design, publicly reachable and holds the authentication decision for everything behind it. There is no segmentation in front of it, because it is the front.
And the interval between disclosure and exploitation keeps compressing. GitLab's CVSS 9.4 went from patch to in-the-wild exploitation in days, with watchTowr reproducing it in minutes. MLflow's SSRF was being scanned for within hours of the CVE being assigned. "Nothing yet" describes the past.
The specific danger of an auth bypass here
Most perimeter flaws give an attacker code execution and a foothold. An authentication bypass on a gateway gives them something quieter: a session.
A session looks like an employee. It carries whatever entitlements that path grants, it appears in logs as a successful connection, and it does not trip the detections built for exploitation. That is the same reason the ADFS signing key work matters — anything that lets an intruder arrive already authenticated skips the part of your monitoring that is actually good.
What to do
- Patch to the specific fixed build, this week, not this quarter.
- After patching, look backwards. Review gateway session logs for authentications that do not match a known user, device or location. A bypass leaves successful logins, not errors.
- Rotate session material and force reauthentication once patched, on the assumption that anything established before the fix survives it.
- Check whether SIP ALG is configured, for the second CVE. Most estates do not use it and should not have it enabled.
- Confirm the appliance is not also serving a management interface to the internet. It is the recurring finding in every NetScaler incident review.
What is not established
- Whether exploitation has begun. None reported at the time of writing, which is a statement about visibility.
- Who found it. Not named in the advisory.
- How the bypass works. Citrix describes the class, not the mechanism, which is standard while estates are unpatched.
- How many appliances are exposed. No scan count has been published.
