--- id: "CVE-2026-19490" kind: "vulnerability" aliases: ["CVE-2026-19490"] title: "Vulnerability in NetScaler ADC and NetScaler Gateway" severity: "critical" cvss: 9.8 epss: null exploited: true status: "open" category: "infrastructure" products: [{"name": "Citrix NetScaler", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "NetScaler ADC", "fixed": ["14.1-73.32", "13.1-63.21", "14.1-73.32 FIPS", "13.1-37.277"], "affected": "14.1 < 14.1-73.32; 13.1 < 13.1-63.21; 14.1-FIPS < 14.1-73.32 FIPS; 13.1-FIPS/NDcPP < 13.1-37.277", "ecosystem": "vendor"}, {"name": "NetScaler Gateway", "fixed": ["14.1-73.32", "13.1-63.21"], "affected": "14.1 < 14.1-73.32; 13.1 < 13.1-63.21", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": ["13.1-37.277"], "affected": ">= 13.1, < 13.1-37.277", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": ["13.1-63.21"], "affected": ">= 13.1, < 13.1-63.21", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": ["14.1-73.32"], "affected": ">= 14.1, < 14.1-73.32", "ecosystem": "vendor"}, {"name": "citrix netscaler application delivery controller", "fixed": [], "affected": ">= 14.1-66.68, <= 14.1-73.32", "ecosystem": "vendor"}, {"name": "citrix netscaler gateway", "fixed": ["13.1-63.21"], "affected": ">= 13.1, < 13.1-63.21", "ecosystem": "vendor"}, {"name": "citrix netscaler gateway", "fixed": ["14.1-73.32"], "affected": ">= 14.1, < 14.1-73.32", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["authentication-bypass", "citrix", "exploited", "infrastructure", "netscaler", "netscaler-adc", "netscaler-gateway", "poc-public", "self-hosted", "vpn"] not_affected_if: ["managed-hosting", "no-gateway-or-aaa-vserver", "no-saml-action-on-newer-builds", "not-aaa-or-gateway-config"] published_at: "2026-08-19T13:17:45+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-24T00:09:50+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-19490", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:29:00+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19490", "first_seen_at": "2026-10-23T23:44:52+00:00"}, {"source": "github-poc", "url": "https://github.com/CompleteTech-LLC/netscaler-cve-2026-19490-check", "first_seen_at": "2026-10-23T23:55:02+00:00"}] --- # Vulnerability in NetScaler ADC and NetScaler Gateway Authentication bypass (CWE-288, CVSS v4 9.3) in customer-managed NetScaler ADC and Gateway. An unauthenticated attacker can skip login when the appliance is a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA vserver. Under 14.1-43.56+ and 13.1-61.28+ (including 14.1 FIPS 14.1-66.68+), it applies only if a SAML action is also configured. Exploited in the wild and in CISA KEV. Fixed 2026-08-19 in the same release as CVE-2026-19489, a SIP ALG buffer overflow. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Citrix NetScaler affected ? fixed ? - vendor:NetScaler ADC affected 14.1 < 14.1-73.32; 13.1 < 13.1-63.21; 14.1-FIPS < 14.1-73.32 FIPS; 13.1-FIPS/NDcPP < 13.1-37.277 fixed 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS, 13.1-37.277 - vendor:NetScaler Gateway affected 14.1 < 14.1-73.32; 13.1 < 13.1-63.21 fixed 14.1-73.32, 13.1-63.21 - vendor:citrix netscaler application delivery controller affected >= 13.1, < 13.1-37.277 fixed 13.1-37.277 - vendor:citrix netscaler application delivery controller affected >= 13.1, < 13.1-63.21 fixed 13.1-63.21 - vendor:citrix netscaler application delivery controller affected >= 14.1, < 14.1-73.32 fixed 14.1-73.32 - vendor:citrix netscaler application delivery controller affected >= 14.1-66.68, <= 14.1-73.32 fixed ? - vendor:citrix netscaler gateway affected >= 13.1, < 13.1-63.21 fixed 13.1-63.21 - vendor:citrix netscaler gateway affected >= 14.1, < 14.1-73.32 fixed 14.1-73.32 ## How to check On the appliance, search the running config for 'add authentication samlAction', 'add authentication vserver' and 'add vpn vserver'. Exposed if a Gateway or AAA vserver exists on a vulnerable build. On 14.1-43.56+ and 13.1-61.28+, a SAML action must also be present. Check the build with 'show version'. Because it is exploited, also review for unexpected sessions and run CISA's forensics triage. ## Fix Upgrade to 14.1-73.32 or later, 13.1-63.21 or later, 14.1-73.32 FIPS or later, or 13.1-37.277 or later for 13.1-FIPS and NDcPP. Secure Private Access Hybrid deployments using NetScaler instances need the same upgrade. Citrix-managed cloud and Adaptive Authentication are patched by Citrix. No workaround is listed in the bulletin. ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-19490 - 2026-10-23T21:29:00+00:00 analyst — Read Citrix bulletin CTX696939 (2026-08-19): CVSS v4 9.3, fixed builds and precondition checks taken from it. Exploitation per CISA KEV (added 2026-09-09) and CSA Singapore, which also reports a public PoC, but I found no PoC link so none is attached. Reporter credit: Samarth Vashisht (JPMorgan Chase). - 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-19490 - 2026-10-23T23:55:02+00:00 github-poc https://github.com/CompleteTech-LLC/netscaler-cve-2026-19490-check ## Documents - [advisory] Citrix bulletin CTX696939 (CVE-2026-19489, CVE-2026-19490) https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html - [describes] BleepingComputer: Citrix urges admins to patch new NetScaler flaws https://www.bleepingcomputer.com/news/security/citrix-urges-admins-to-patch-new-netscaler-flaws-as-soon-as-possible/ - [mentions] CSA Singapore AL-2026-115: active exploitation, public PoC reported https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-115/ - [poc] CompleteTech-LLC/netscaler-cve-2026-19490-check https://github.com/CompleteTech-LLC/netscaler-cve-2026-19490-check ## From the sources Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_