CVE-2026-19490

What is Citrix NetScaler?

Citrix NetScaler ADC (application delivery controller) and NetScaler Gateway are edge appliances that sit at the boundary of enterprise networks. They load-balance applications and broker remote access through SSL VPN, ICA Proxy, Clientless VPN (CVPN), and RDP Proxy, and they can act as an AAA (authentication, authorization, accounting) virtual server. Because they are internet-facing and hold session material for remote access, NetScaler appliances are among the most heavily attacked devices in the industry. The 2023 "CitrixBleed" flaw (CVE-2023-4966) set the pattern: a NetScaler authentication or memory-disclosure bug is weaponized within days and used for ransomware and espionage intrusions.

Overview

CVE-2026-19490 is an authentication bypass (CWE-288, alternate path or channel) in NetScaler ADC and Gateway, rated CVSS 9.8. It applies when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. An unauthenticated remote attacker can bypass authentication under those configurations. Citrix published the fix on 2026-08-19; exploitation attempts followed a public proof of concept in early September, and CISA added the CVE to KEV on 2026-09-09.

Affected Versions

Versions 12.1 and 13.0 are end of life and remain vulnerable; Citrix advises upgrading to a supported branch. There are no workarounds. The vulnerable configuration precondition (Gateway or AAA vserver) is the same one required by several earlier NetScaler CVEs.

Technical Details

The appliance exposes an alternate path to a code flow that should require authentication. When NetScaler is configured as a Gateway or AAA virtual server, a remote attacker can reach that path and bypass the authentication check, gaining access to functionality or session context that should be gated behind login.

Attack characteristics:

• Authentication: none
• Complexity: low
• Vector: network, to the Gateway or AAA virtual server
• Impact: high to confidentiality, integrity, and availability (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

The same 2026-08-19 bulletin also fixed CVE-2026-19489, a memory-overflow denial of service rated CVSS 8.8. Both were addressed in the same builds, so a single upgrade closes both. This CVE is distinct from the earlier CVE-2026-8452 (a pre-auth SAML SSO heap overflow) but shares the Gateway/AAA precondition.

Discovery

Citrix credited Samarth Vashisht of the JPMorgan Chase penetration-testing team for collaborative research leading to the fix. There was no public exploitation at disclosure.

Exploitation Context

There is no distinct nickname for this CVE; press coverage invoked "CitrixBleed" only as a historical comparison. Vulnerability intelligence firm Previdian (founder Ryan Dewhurst) documented three exploitation attempts on 2026-09-03 from source IPs in Australia, the United States, and Germany, following publication of what Dewhurst described as a credible public proof of concept. Dewhurst cautioned that this confirms attempts, not confirmed successful compromise. Belgium's Centre for Cybersecurity (CCB) also warned of exploitation attempts. Shadowserver reported more than 22,000 NetScaler ADC appliances and over 1,700 Gateway instances exposed online, though it is unknown how many run the vulnerable configuration or remain unpatched.

Remediation

1. Upgrade immediately to 14.1-73.32, 13.1-63.21, or the matching FIPS/NDcPP build. There is no workaround. If you run 12.1 or 13.0, migrate to a supported branch.
2. Terminate active sessions after upgrading. As with prior NetScaler flaws, patching does not invalidate sessions an attacker may already hold; run kill icaconnection -all and kill pcoipConnection -all, and clear AAA and VPN sessions, per Citrix guidance for edge compromises.
3. Hunt for prior compromise if the appliance was exposed before your patch date. Review NetScaler shell and web logs for anomalous authentication events, unexpected admin actions, and web shells in the /var/netscaler and /netscaler/ns_gui paths that past campaigns have abused.
4. Rotate secrets the appliance holds or fronts: AAA and LDAP bind credentials, session and encryption keys, and any single-sign-on signing material.
5. Restrict management access to the NSIP and management interfaces, and place the Gateway behind additional monitoring given the exposure counts reported for this class of device.