NetScaler auth bypass at 9.3: the box is the perimeter, so patch it this week
CVE-2026-19490 lets an unauthenticated attacker past NetScaler gateway and AAA virtual servers. Rapid7 has seen no exploitation yet and expects it shortly.
The Watch · Security desk
What happened
- Citrix on Wednesday announced patches for two vulnerabilities in NetScaler ADC and NetScaler Gateway, including a critical-severity flaw.
- CVE-2026-19490 (CVSS 9.3) is described as an authentication bypass using an alternative path and impacts NetScaler appliances configured as a gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server.
- On August 19, 2026, a security advisory was published for CVE-2026-19490, a critical authentication bypass vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway, carrying a CVSS v4.0 base score of 9.3.
- Rapid7 says the vulnerability can be exploited remotely by an unauthenticated attacker over the network without user interaction or elevated privileges.
- Per Citrix's advisory, the defect impacts NetScaler ADC and NetScaler Gateway versions 14.1-43.56 or later, 14.1-66.68-FIPS or later, 14.1-43.55 or earlier, 13.1-61.28 or later, 13.1-61.27 or earlier, and 13.1 FIPS.
Why it matters
Citrix shipped patches on Wednesday for two flaws in NetScaler ADC and NetScaler Gateway, the more serious being CVE-2026-19490, an authentication bypass by an alternative path carrying a CVSS v4.0 base score of 9.3 [1][2][3]. It affects appliances configured as a gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server, which is precisely the role that puts the device in the DMZ with a listener open to the internet [2][14].
Rapid7 says the bug is reachable by a remote, unauthenticated attacker over the network, with no user interaction and no elevated privileges [7]. As of August 19, the day the advisory went out, Rapid7 had not observed evidence of exploitation in the wild [6]. It also wrote that because these systems are frequently deployed in enterprise DMZs and exposed to the public internet, authentication bypass vulnerabilities affecting Citrix products are "nearly always exploited by threat actors", and that patching should be treated as an emergency because Citrix products tend to see exploitation quickly [14][9].
The fixed builds are 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS, and 13.1-37.277 for 13.1-FIPS and 13.1-NDcPP [4]. Rapid7 states affected systems as anything prior to those builds in each train [10]. The version list in Citrix's advisory, as reported, is messier: it names 14.1-43.56 or later, 14.1-66.68-FIPS or later, 14.1-43.55 or earlier, 13.1-61.28 or later, 13.1-61.27 or earlier, and 13.1 FIPS [8]. Read the two lists together and the practical conclusion is that there is no intermediate build to sit on within 14.1 or 13.1; forward to a fixed release is the only exit [15].
Citrix's own exposure test is a configuration grep, according to Rapid7: look for "add authentication samlAction.*", "add authentication vserver .*", or "add vpn vserver .*". If one or more is present and the appliance is on an affected version, it is likely exploitable [11]. That is a fast triage step for anyone with a fleet and an inventory they do not fully trust.
The same builds also fix CVE-2026-19489, a high-severity memory overflow that can cause unexpected behaviour or denial of service when SIP ALG is enabled at an LSN group configuration, so this is one upgrade, not two [4][5]. Citrix adds that Secure Private Access Hybrid deployments using NetScaler instances are affected as well, and those instances need the same recommended builds [13].
One gap worth naming: the mitigation guidance in circulation is review the advisory, apply the updates, and inspect the configuration [11][12]. Nothing in the published material describes what a successful bypass grants an attacker or whether existing sessions on a patched appliance should be invalidated [17]. On this appliance class, that is a question to put to Citrix support rather than an assumption to make in either direction.
Watch for the first credible exploitation report, since Rapid7's expectation is that it arrives soon [9]. Rapid7 said a vulnerability check for Exposure Command, InsightVM and Nexpose was expected in the August 20 content release [16].
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence78
- Adoption62
- Hype gap+10
- Incentives38
- Confidence75
Perspective Coverage
5 publishers- Builder
- Builder 14%
- Operator
- Operator 73%
- Investor
- Investor 13%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Citrix on Wednesday announced patches for two vulnerabilities in NetScaler ADC and NetScaler Gateway, including a critical-severity flaw.
- [2]
CVE-2026-19490 (CVSS 9.3) is described as an authentication bypass using an alternative path and impacts NetScaler appliances configured as a gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server.
- [3]
On August 19, 2026, a security advisory was published for CVE-2026-19490, a critical authentication bypass vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway, carrying a CVSS v4.0 base score of 9.3.
- [4]
NetScaler ADC and Gateway versions 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS, and 13.1-FIPS and 13.1-NDcPP 13.1-37.277 contain fixes for CVE-2026-19490 and for CVE-2026-19489.
- [5]
CVE-2026-19489 is a high-severity memory overflow issue that could lead to unexpected behavior or denial-of-service if SIP ALG is enabled at an LSN group configuration.
- [6]
As of August 19, 2026, Rapid7 has not observed evidence that CVE-2026-19490 is being exploited in the wild.
- [7]
Rapid7 says the vulnerability can be exploited remotely by an unauthenticated attacker over the network without user interaction or elevated privileges.
- [8]
Per Citrix's advisory, the defect impacts NetScaler ADC and NetScaler Gateway versions 14.1-43.56 or later, 14.1-66.68-FIPS or later, 14.1-43.55 or earlier, 13.1-61.28 or later, 13.1-61.27 or earlier, and 13.1 FIPS.
- [9]
Rapid7 expects threat actors to exploit the critical bug shortly and says organizations should prioritize patching affected systems on an emergency basis, since Citrix products are high-value targets that tend to quickly see exploitation in the wild.
- [10]
Rapid7 lists CVE-2026-19490 as affecting NetScaler ADC and Gateway 14.1 versions prior to 14.1-73.32, 13.1 versions prior to 13.1-63.21, NetScaler ADC FIPS versions prior to 14.1-73.32 FIPS, and NetScaler ADC FIPS and NDcPP versions prior to 13.1-37.277.
- [11]
According to Citrix, customers can determine whether systems are vulnerable to CVE-2026-19490 by inspecting the NetScaler configuration for 'add authentication samlAction.*', 'add authentication vserver .*', or 'add vpn vserver .*'; if one or more is present and the system runs an affected version, it is likely to be exploitable.
- [12]
Rapid7's mitigation guidance is that organizations running affected NetScaler ADC or Gateway appliances should review the official NetScaler advisory and apply the required updates to affected systems on an emergency basis.
- [13]
Citrix says Secure Private Access Hybrid deployments using NetScaler instances are also affected by the vulnerabilities and customers need to upgrade these NetScaler instances to the recommended builds.
- [14]
Rapid7 says NetScaler ADC and Gateway are commonly positioned at or near the network perimeter and frequently deployed in enterprise DMZs exposed to the public internet, and that authentication bypass vulnerabilities affecting Citrix products are nearly always exploited by threat actors.
- [15]
Because the advertised affected ranges include builds both earlier and later than intermediate releases in the 14.1 and 13.1 trains, no intermediate build within those trains is listed as unaffected; only the named fixed builds are.
- [16]
Rapid7 said customers can assess exposure to CVE-2026-19490 using a vulnerability check for Exposure Command, InsightVM and Nexpose expected to be available in the August 20 content release.
- [17]
The published guidance for CVE-2026-19490 consists of applying the fixed builds and inspecting configuration entries; it does not state what access a successful bypass yields or whether existing sessions must be invalidated after patching.
Sources
5 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comCitrix urges admins to patch new NetScaler flaws as soon as possible
2 articles · August 22, 2026
- blog.rapid7.comCVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway
1 article · August 19, 2026
- helpnetsecurity.comCitrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490)
1 article · August 21, 2026
- securityweek.comExploitation Expected for Critical Authentication Bypass Patched in Citrix NetScaler
2 articles · August 22, 2026
- thehackernews.comCritical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers
1 article · August 20, 2026