CISA Warns of Citrix NetScaler Authentication Bypass Vulnerability Exploited in Attacks
CISA adds exploited Citrix NetScaler authentication bypass CVE-2026-19490 to the KEV catalog; federal agencies must patch by September 12.
CISA added CVE-2026-19490, a CWE-288 authentication bypass affecting NetScaler ADC and Gateway deployments configured as AAA virtual servers or Gateway services (including SSL VPN, ICA Proxy, and RDP Proxy), to the Known Exploited Vulnerabilities catalog. Citrix released fixes on August 19, 2026; honeypots recorded 56 attack attempts between September 3 and 8 after a public PoC, though no confirmed production compromises have been reported. Affected builds include 14.1 before 14.1-73.32 and 13.1 before 13.1-63.21; newer installations require SAML IdP configuration to be exposed.
- CVE-2026-19490 lets unauthenticated attackers bypass login on NetScaler AAA virtual servers and Gateway configurations.
- Exploitation observed in honeypots (56 attempts September 3-8) after public PoC; no confirmed compromises yet.
- Fixes ship in 14.1-73.32 and 13.1-63.21; CISA KEV deadline September 12 with mandatory forensic triage.
- CVEs
- CVE-2026-19490
- Vendors
- Citrix
- Products
- NetScaler ADCNetScaler Gateway
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19490 | Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway | 9.3 | 33% | KEVPoC | KEV |
From the original article
2 min read at cybersecuritynews.com
CISA added a critical Citrix NetScaler authentication bypass flaw (CVE-2026-19490) to its Known Exploited Vulnerabilities catalog after observing in-the-wild attacks targeting the issue. Federal civilian agencies must apply vendor mitigations by September 12, 2026.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.