CVE-2026-19490 | Citrix NetScaler ADC and NetScaler Gateway Authentication Bypass Vulnerability
Unauthenticated attackers can bypass Citrix NetScaler Gateway or AAA authentication via KEV-listed CVE-2026-19490.
CVE-2026-19490 is a critical (CVSS 9.8) authentication bypass (CWE-288) in customer-managed Citrix NetScaler ADC and Gateway appliances configured as a Gateway or AAA virtual server. Some builds also require a configured SAML action, and Citrix lists no workaround. Fixed builds include 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS, and 13.1-37.277. Citrix disclosed it on August 19, 2026, CISA added it to the KEV catalog on September 9 requiring forensic triage, and Horizon3.ai published a NodeZero exposure test on September 28.
- CVSS 9.8 CWE-288 bypass hits customer-managed NetScaler Gateway or AAA virtual servers.
- SAML action is an extra precondition only on newer listed builds.
- Patches: 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS, and 13.1-37.277; no workaround.
- CISA KEV entry dated September 9, 2026 requires forensic triage.
- Horizon3 NodeZero test checks exploitability and confirms the fix.
- CVEs
- CVE-2026-19490
- Vendors
- Citrix
- Organizations
- CISAHorizon3.aiCloud Software Group
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19490 | Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway | 9.3 | 33% | KEVPoC | KEV |
From the original article
2 min read at horizon3.ai
CVE-2026-19490 is a critical Citrix NetScaler ADC and Gateway authentication bypass vulnerability included in CISA’s Known Exploited Vulnerabilities catalog. NodeZero® Rapid Response safely validates exposure.
By Horizon3 · horizon3.ai
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.