Citrix NetScaler Auth Bypass CVE-2026-19490 Is Now Under Attack

Attackers are exploiting CVE-2026-19490, a critical authentication bypass in Citrix NetScaler ADC and NetScaler Gateway, roughly two weeks after Citrix patched it on August 19, 2026. Vulnerability intelligence firm Previdian saw requests matching a public proof of concept hit its NetScaler sensors on September 3 from three distinct source IPs geolocated to Australia, the United States and Germany. Shadowserver tracks more than 22,000 NetScaler ADC appliances and close to 1,700 Gateway instances exposed online. If one of them is yours and it is not on a fixed build, this is an emergency change, not a maintenance window item.

What CVE-2026-19490 actually does

The flaw carries a CVSS v4.0 base score of 9.3. It allows an unprivileged, remote attacker to bypass authentication with no user interaction and no prior credentials when the appliance is configured as an AAA virtual server or as a Gateway, meaning SSL VPN, ICA Proxy, CVPN or RDP Proxy. Whether a given box is exploitable depends on the firmware version and on whether a SAML Action is configured.

That configuration list describes the reason most organizations bought a NetScaler in the first place. These appliances sit in the DMZ, terminate remote access for the entire workforce and broker authentication for internal applications. A bypass there is not just a foothold on an edge device, it is access to the services behind the edge device using the trust the gateway exists to enforce. Reporting on the public exploit code says it can reach services protected by the appliance without valid credentials.

Fifteen days from patch to attack

Citrix published the advisory and fixed builds on August 19, 2026. Rapid7 noted at the time that it had seen no in the wild exploitation yet, and told customers to patch on an emergency basis anyway on the reasoning that Citrix edge products are high value targets that see exploitation quickly. That call held. A credible proof of concept went public, and by September 3 the scanning was live. Treat 15 days as the realistic upper bound on your patch window for this class of product.

CVE-2026-19490 had not been added to the CISA Known Exploited Vulnerabilities catalog as of publication, so there is no federal remediation deadline attached to it yet. Do not use that as scheduling input.

Affected and fixed builds

Citrix bulletin CTX696939 lists the affected trains and the builds that carry the fix:

• NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.32
• NetScaler ADC and NetScaler Gateway 13.1 before 13.1-63.21
• NetScaler ADC 14.1-FIPS before 14.1-73.32 FIPS
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1-37.277

The advisory does not list 12.1 or other end of life branches as affected, which is not the same as calling them safe. Anything on an unsupported train gets no fix for this or the next one and should be replaced or taken off the internet on its own merits.

Check whether you are exposed

Two checks, both read only. The first confirms the running build. The second confirms whether the appliance carries the configuration the bypass needs, which is the same signal Rapid7 called out: a samlAction entry, or an authentication or VPN virtual server.

ssh [email protected] "show ns version"
ssh [email protected] "show ns runningConfig" | grep -E "add authentication samlAction|add authentication vserver|add vpn vserver"

If the grep returns nothing, your exposure through this specific path is lower, but the version string is still the deciding fact. Patch on build, not on config.

Patch, then invalidate every session

Upgrade to the fixed build for your train, then assume any session established before the upgrade could belong to an attacker. Citrix used exactly this pattern for CitrixBleed in 2023 and the reasoning has not changed: a bypass that yields a valid session survives the patch unless you tear the sessions down.

ssh [email protected] "kill aaa session -all"
ssh [email protected] "kill icaconnection -all"
ssh [email protected] "save ns config"

What to hunt for

• Successful SSLVPN LOGIN entries in /var/log/ns.log with no preceding authentication event for the same Client_ip
• New or modified authentication samlAction entries, authentication policies or vpn vserver bindings that no change ticket explains
• Administrative logins to the NSIP from source addresses outside your management network
• Internal application access from accounts whose gateway session start you cannot account for

Also diff the running config against your last known good backup. An attacker who lands administrative access on a NetScaler typically persists in the configuration, and the config is the smallest artifact you can compare with certainty. Field Effect's guidance on this CVE points the same direction: review authentication logs, remote access records and administrative activity, and validate account activity across SSL VPN, published application and RDP proxy paths.

Bottom line

A 9.3 severity flaw, unauthenticated, no user interaction, on the device whose entire job is standing between the internet and everything else, with working exploit code in public and scanning already underway from three continents. Get to 14.1-73.32 or 13.1-63.21, kill the sessions, then read the logs. In that order.

ssh [email protected] "show ns version"

ssh [email protected] "show ns runningConfig" | grep -E "add authentication samlAction|add authentication vserver|add vpn vserver"

for h in netscaler.example.com gw.example.com; do printf '%s ' "$h"; curl -sk -o /dev/null -w '%{http_code}\n' "https://$h/vpn/index.html"; done

scp ./build-14.1-73.32_nc_64.tgz [email protected]:/var/nsinstall/

ssh [email protected] "kill aaa session -all"
ssh [email protected] "kill icaconnection -all"
ssh [email protected] "save ns config"

ssh [email protected] "disable vpn vserver GW_VSERVER_NAME"