NetScaler Critical Authentication Bypass: Citrix Urges Immediate Patching

The flaw allows authentication to be bypassed

Citrix has released updates for two vulnerabilities affecting NetScaler ADC and NetScaler Gateway. The most serious is CVE-2026-19490, a critical authentication-bypass flaw with a CVSS score of 9.3.

The issue allows an attacker to circumvent authentication controls by exploiting an alternative path. According to Rapid7’s assessment, the attack can be carried out remotely, without credentials or user interaction.

The vulnerability affects NetScaler appliances configured to provide:

• SSL VPN;
• ICA Proxy;
• CVPN;
• RDP Proxy;
• AAA virtual servers.

The risk is primarily driven by the role these devices play. NetScaler ADC and NetScaler Gateway are often deployed at the network perimeter or inside DMZs, with interfaces accessible from the Internet. A bypass on this attack surface could expose services and resources normally protected by authentication.

Which products and versions are affected

The Citrix advisory lists the following NetScaler ADC and NetScaler Gateway versions as affected:

• 14.1-43.56 or later;
• 14.1-66.68-FIPS or later;
• 14.1-43.55 or earlier;
• 13.1-61.28 or later;
• 13.1-61.27 or earlier;
• 13.1 FIPS.

Builds containing the fix for CVE-2026-19490 are:

• 14.1-73.32;
• 13.1-63.21;
• 14.1-73.32 FIPS;
• 13.1-FIPS;
• 13.1-NDcPP 13.1-37.277.

Administrators should verify both the installed release and the support branch in use. FIPS or NDcPP deployments require particular attention because the applicable fixes do not always match those for standard installations.

Checking only the major version is not enough. The full build reported by the appliance must be verified, along with the update’s compatibility with the current configuration.

SIP ALG can also cause a denial-of-service

The same builds address CVE-2026-19489, a high-severity vulnerability involving a memory overflow. The flaw can cause unexpected behavior or trigger a denial-of-service condition when SIP ALG is enabled in an LSN group configuration.

No CVSS score has been provided for this vulnerability.

The SIP ALG requirement narrows the scope compared with the authentication bypass, but it does not eliminate the operational risk. An appliance crash or abnormal behavior could disrupt published services, remote access, and application flows that depend on NetScaler.

Secure Private Access Hybrid environments using NetScaler instances are also affected. Citrix requires these systems to be updated to the recommended builds, including appliances that are not directly exposed to the Internet.

Why the risk is high even without observed exploitation

Rapid7 has not identified signs of active exploitation of CVE-2026-19490. However, the absence of evidence does not reduce the need for rapid action.

NetScaler appliances are attractive targets because they:

• are often publicly accessible;
• concentrate remote-access and application-publishing functions;
• can protect numerous services through a single authentication point;
• are widely deployed in large enterprise networks.

Rapid7 considers exploitation attempts likely in the near term. The combination of Internet exposure, strategic value, and the nature of the flaw makes patching speed a decisive factor.

It is not known whether CVE-2026-19490 has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, and no CISA mitigation deadline has been specified. It is also unclear whether other recent Citrix vulnerabilities relevant to this product line are listed in the KEV catalog.

What administrators should verify

The recommendation is to apply the patches with emergency priority to all affected systems. This should include instances used by Secure Private Access Hybrid.

Before updating, administrators should:

1. inventory all NetScaler ADC and Gateway appliances;
2. check the complete build number, including FIPS and NDcPP variants;
3. identify systems configured as SSL VPN, ICA Proxy, CVPN, or RDP Proxy;
4. verify AAA virtual servers;
5. identify interfaces exposed directly or indirectly to the Internet;
6. review LSN groups and determine whether SIP ALG is enabled.

After installing the correct builds, verify that remote-access services are operating normally and that the configuration was not altered during the maintenance activity.

Patching does not replace retrospective threat hunting. Security teams should review logs for:

• successful access without the expected corresponding authentication;
• unusual or repeatedly failed authentication attempts;
• connections from unexpected addresses;
• unexpected use of VPN, proxy, or AAA virtual servers;
• appliance restarts, errors, or abnormal behavior;
• requests to administrative interfaces or normally unused services.

The available indicators do not demonstrate ongoing exploitation. NetScaler logs should therefore be correlated with VPN, firewall, identity-system, and published-application logs.

The priority is to reduce exposure, not wait for further confirmation

Organizations unable to update immediately should reduce NetScaler interface exposure as much as possible and restrict administrative access to authorized networks. The brief does not identify a Citrix-provided workaround for CVE-2026-19490 or CVE-2026-19489.

Temporary measures must not be treated as a substitute for patching. A vulnerable appliance used as a remote-access gateway could provide an unauthenticated attacker with a direct entry point to protected corporate resources. The appropriate response is to update to the required build, verify the configuration, and review events recorded before and after remediation.