Exploited Citrix NetScaler auth bypass CVE-2026-19490 lands on CISA KEV with September 12 federal patch deadline

CISA added actively exploited Citrix NetScaler authentication bypass CVE-2026-19490 (CVSS 9.3) to the Known Exploited Vulnerabilities catalog on 9 September 2026, ordering federal civilian agencies to patch by 12 September under BOD 26-04; honeypots logged 56…

Citrix published a security advisory on 19 August 2026 fixing two critical-severity issues in NetScaler ADC and NetScaler Gateway versions 14.1 before 14.1-73.32 and 13.1 before 13.1-63.21, plus FIPS/NDcPP builds; fixed builds are 14.1-73.32, 13.1-63.21, and FIPS build 13.1-37.277 (the Canadian Centre also lists 14.1-73.32 for FIPS variants). CVE-2026-19490 (CVSS 9.3, CWE-288) is an authentication bypass via an alternate path exploitable by a remote unauthenticated attacker when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server; Rapid7 assessed it is remotely exploitable without authentication. Sources agree a SAML-related configuration is involved but differ on specifics: CERT-EU says a SAML action configuration is a precondition on builds 14.1-43.56+ and 13.1-61.28+, the Canadian Centre for Cyber Security and Cyber Security News describe appliances configured as a SAML IdP, and Security Affairs characterizes it as a SAML HTTP-Redirect binding authentication bypass. CVE-2026-19489 (CVSS 8.8, CWE-120) is a classic buffer overflow causing memory overflow, unpredictable behaviour, or denial-of-service conditions; the sources disagree on the vulnerable configuration — CERT-EU says it requires SIP ALG enabled on a Large Scale NAT (LSN) group, whereas the Canadian Centre ties it to a SAML IdP configuration. The Canadian Centre issued alert AL26-019 on 2026-09-04 and updated it as AV26-833 Update 1 on 2026-09-09, the same day CISA added CVE-2026-19490 to the Known Exploited Vulnerabilities catalog. Reports on 2026-09-10 (SecurityWeek, The Hacker News, Cyber Security News, Security Affairs) specify that the KEV entry gives Federal Civilian Executive Branch agencies until 12 September 2026 to patch under BOD 26-04 — three days from the listing — with Cyber Security News noting mandatory forensic triage. Previdian sensor data shows exploitation ongoing since at least 3 September 2026, one day after a public exploit appeared on GitHub; honeypots recorded 56 attack attempts between 3 and 8 September, with matching requests from three IP addresses across three countries. Cyber Security News reported no confirmed production compromises as of 10 September, while CISA's KEV listing itself indicates confirmed active exploitation. The Canadian Centre urges emergency patching and monitoring of authentication logs for unauthorized access. The same September KEV batch also added Cisco Secure Firewall Management…