TL;DR
- what: Threat actors started exploiting CVE-2026-19490, a critical authentication bypass in Citrix NetScaler ADC and NetScaler Gateway, after a working proof of concept was published.
- impact: An unauthenticated remote attacker can bypass authentication on AAA virtual servers and Gateway deployments and reach the SSL VPN, ICA Proxy, CVPN and RDP Proxy services behind the appliance, with over 22,000 ADC boxes and nearly 1,700 Gateway instances reachable from the internet.
- fix: Upgrade to NetScaler 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS or 13.1-37.277 per Citrix bulletin CTX696939, then kill all existing AAA and ICA sessions so pre-patch sessions cannot be replayed.
- who: Any organization running an internet-facing NetScaler ADC or Gateway on a 14.1 or 13.1 build below the fixed versions, including FIPS and NDcPP variants.
Attackers are exploiting CVE-2026-19490, a critical authentication bypass in Citrix NetScaler ADC and NetScaler Gateway, roughly two weeks after Citrix patched it on August 19, 2026. Vulnerability intelligence firm Previdian saw requests matching a public proof of concept hit its NetScaler sensors on September 3 from three distinct source IPs geolocated to Australia, the United States and Germany. Shadowserver tracks more than 22,000 NetScaler ADC appliances and close to 1,700 Gateway instances exposed online. If one of them is yours and it is not on a fixed build, this is an emergency change, not a maintenance window item.
What CVE-2026-19490 actually does
The flaw carries a CVSS v4.0 base score of 9.3. It allows an unprivileged, remote attacker to bypass authentication with no user interaction and no prior credentials when the appliance is configured as an AAA virtual server or as a Gateway, meaning SSL VPN, ICA Proxy, CVPN or RDP Proxy. Whether a given box is exploitable depends on the firmware version and on whether a SAML Action is configured.
That configuration list describes the reason most organizations bought a NetScaler in the first place. These appliances sit in the DMZ, terminate remote access for the entire workforce and broker authentication for internal applications. A bypass there is not just a foothold on an edge device, it is access to the services behind the edge device using the trust the gateway exists to enforce. Reporting on the public exploit code says it can reach services protected by the appliance without valid credentials.
⚠️ A quiet log is not a clean bill of health — Previdian was clear that its sensor hits show exploitation attempts, not confirmed compromise. The inverse matters more for defenders: an absence of failed logins proves nothing, because a working authentication bypass produces successful sessions, not failures. Verify your exposure by build number, not by log volume.
Fifteen days from patch to attack
Citrix published the advisory and fixed builds on August 19, 2026. Rapid7 noted at the time that it had seen no in the wild exploitation yet, and told customers to patch on an emergency basis anyway on the reasoning that Citrix edge products are high value targets that see exploitation quickly. That call held. A credible proof of concept went public, and by September 3 the scanning was live. Treat 15 days as the realistic upper bound on your patch window for this class of product.
CVE-2026-19490 had not been added to the CISA Known Exploited Vulnerabilities catalog as of publication, so there is no federal remediation deadline attached to it yet. Do not use that as scheduling input.
Affected and fixed builds
Citrix bulletin CTX696939 lists the affected trains and the builds that carry the fix:
- NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.32
- NetScaler ADC and NetScaler Gateway 13.1 before 13.1-63.21
- NetScaler ADC 14.1-FIPS before 14.1-73.32 FIPS
- NetScaler ADC 13.1-FIPS and 13.1-NDcPP before 13.1-37.277
The advisory does not list 12.1 or other end of life branches as affected, which is not the same as calling them safe. Anything on an unsupported train gets no fix for this or the next one and should be replaced or taken off the internet on its own merits.
Check whether you are exposed
Two checks, both read only. The first confirms the running build. The second confirms whether the appliance carries the configuration the bypass needs, which is the same signal Rapid7 called out: a samlAction entry, or an authentication or VPN virtual server.
ssh nsroot@netscaler.example.com "show ns version"
ssh nsroot@netscaler.example.com "show ns runningConfig" | grep -E "add authentication samlAction|add authentication vserver|add vpn vserver"
If the grep returns nothing, your exposure through this specific path is lower, but the version string is still the deciding fact. Patch on build, not on config.
Patch, then invalidate every session
Upgrade to the fixed build for your train, then assume any session established before the upgrade could belong to an attacker. Citrix used exactly this pattern for CitrixBleed in 2023 and the reasoning has not changed: a bypass that yields a valid session survives the patch unless you tear the sessions down.
ssh nsroot@netscaler.example.com "kill aaa session -all"
ssh nsroot@netscaler.example.com "kill icaconnection -all"
ssh nsroot@netscaler.example.com "save ns config"
Order matters — Killing sessions before the upgrade only inconveniences your users, because the attacker reconnects through the same hole. Upgrade first, confirm that show ns version reports the fixed build, then kill sessions and force a credential reset for accounts that authenticate through the gateway.
What to hunt for
- Successful SSLVPN LOGIN entries in /var/log/ns.log with no preceding authentication event for the same Client_ip
- New or modified authentication samlAction entries, authentication policies or vpn vserver bindings that no change ticket explains
- Administrative logins to the NSIP from source addresses outside your management network
- Internal application access from accounts whose gateway session start you cannot account for
Also diff the running config against your last known good backup. An attacker who lands administrative access on a NetScaler typically persists in the configuration, and the config is the smallest artifact you can compare with certainty. Field Effect's guidance on this CVE points the same direction: review authentication logs, remote access records and administrative activity, and validate account activity across SSL VPN, published application and RDP proxy paths.
Bottom line
A 9.3 severity flaw, unauthenticated, no user interaction, on the device whose entire job is standing between the internet and everything else, with working exploit code in public and scanning already underway from three continents. Get to 14.1-73.32 or 13.1-63.21, kill the sessions, then read the logs. In that order.
Originally published on RedEye Threat Intelligence.
Top comments (0)