Citrix NetScaler ADC and Gateway login bypass CVE-2026-19490 used in attacks; fixed builds available
CISA says attackers are using CVE-2026-19490, a login bypass in Citrix NetScaler Gateway and AAA servers. Citrix fixed it on 19 Aug in 14.1-73.32 and 13.1-63.21 (and FIPS builds).
If your business runs its own NetScaler ADC or Gateway, upgrade to 14.1-73.32, 13.1-63.21 or the matching FIPS build now, then ask your IT provider to check for unexpected logins. Families with no NetScaler need do nothing.
What’s happening
CVE-2026-19490 is an authentication bypass in Citrix NetScaler ADC and NetScaler Gateway. When an appliance is set up as a Gateway (SSL VPN, ICA Proxy, CVPN or RDP Proxy) or as an AAA virtual server, a remote attacker with no password may be able to get past the login. Citrix rates it 9.3 on CVSS v4.0 (NVD lists 9.8 on the older scale). Citrix published bulletin CTX696939 on 19 August 2026 with fixed builds 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS and 13.1-37.277, and says there are no workarounds. The same bulletin fixes CVE-2026-19489, a memory overflow that can crash the appliance when SIP ALG is enabled on a Large Scale NAT group. On 9 September CISA listed CVE-2026-19490 as being used in attacks. Citrix's bulletin made no exploitation statement when we read it, and Rapid7 had seen none as of 19 August. Citrix-managed cloud services are updated by Cloud Software Group; only customer-managed appliances need action. Cloud marketplace images had not been refreshed as of 21 August; current status is not confirmed.
- What
- Flaw
- Affects
- Citrix NetScaler ADC and NetScaler Gateway (customer-managed)
- Affected
- NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.32
NetScaler ADC and NetScaler Gateway 13.1 before 13.1-63.21
NetScaler ADC FIPS before 14.1-73.32 FIPS
NetScaler ADC FIPS and NDcPP before 13.1-37.277
Secure Private Access Hybrid deployments that use customer-managed NetScaler instances - Fixed in
- 14.1-73.32 and later
13.1-63.21 and later
14.1-73.32 FIPS and later
13.1-37.277 and later (13.1-FIPS and 13.1-NDcPP) - Since
- 9 Sept 2026
- Closed
- 9 Sept 2026
Timeline
- CISA added
CISA added CVE-2026-19490 to its list of vulnerabilities being used in attacks, describing it as letting an unauthenticated remote attacker bypass authentication on appliances set up as a Gateway or AAA virtual server. The listing links to Citrix's bulletin; the bulletin itself did not carry an exploitation statement when we read it.
- Update
Help Net Security reported that Rapid7 had seen no exploitation as of 19 August but urged emergency patching. It also noted that NetScaler images on the AWS, Azure and Google Cloud marketplaces had not yet been refreshed with patched builds.
- Made publicFixed
Citrix published security bulletin CTX696939 for NetScaler ADC and NetScaler Gateway, covering CVE-2026-19490 (authentication bypass, CVSS v4.0 9.3) and CVE-2026-19489 (memory overflow, 8.8). Fixed builds were released the same day: 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS and 13.1-37.277. The bulletin made no statement about exploitation and listed no workarounds.
Sources
- NetScaler ADC and NetScaler Gateway Security Bulletin (CTX696939)Citrix · 19 Aug 2026
- Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490)Help Net Security · 21 Aug 2026