Secure Private Access (Product): news timeline & CVEs

CVE-2026-19490 | Citrix NetScaler ADC and NetScaler Gateway Authentication Bypass Vulnerability

Unauthenticated attackers can bypass Citrix NetScaler Gateway or AAA authentication via KEV-listed CVE-2026-19490.

CVE-2026-19490 is a critical (CVSS 9.8) authentication bypass (CWE-288) in customer-managed Citrix NetScaler ADC and Gateway appliances configured as a Gateway or AAA virtual server. Some builds also require a configured SAML action, and Citrix lists no workaround. Fixed builds include 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS, and 13.1-37.277. Citrix disclosed it on August 19, 2026, CISA added it to the KEV catalog on September 9 requiring forensic triage, and Horizon3.ai published a NodeZero exposure test on September 28.

Horizon3.aiupdated Sep 29, 21:30 UTC · 6h agofirst Sep 28, 16:35 UTC · 1d agoExploit / PoC in the wild 23 sources CVE-2026-194901

Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)

Citrix patched NetScaler zero-days CVE-2026-88771 and CVE-2026-88772 after weeks of global exploitation planting webshells.

Citrix patched eight NetScaler ADC and Gateway flaws, including actively exploited zero-days CVE-2026-88771 and CVE-2026-88772 used for weeks to plant webshells. CVE-2026-88771 is unauthenticated remote command execution on default configurations; CVE-2026-88772 is a memory overflow leading to RCE or denial of service when DTLS is enabled. CISA added both to the KEV catalog and ordered US federal civilian agencies to remediate and triage by September 30, 2026. Citrix says customer-managed 14.1 and 13.1 builds, FIPS variants, and Secure Private Access Hybrid deployments are affected.

Help Net Securityupdated Sep 29, 21:30 UTC · 6h agofirst Sep 28, 09:51 UTC · 1d agoExploit / PoC in the wild 23 sources CVE-2026-88771 CVE-2026-88772

Secure Private Access

Timeline2 articles

Related CVEsby mentions

Appears with

CVE-2026-19490 | Citrix NetScaler ADC and NetScaler Gateway Authentication Bypass Vulnerability

Citrix NetScaler RCE zero-days exploited globally for weeks (CVE-2026-88771, CVE-2026-88772)