Critical Citrix NetScaler authentication bypass targeted after exploit code surfaces

The Canadian Centre for Cyber Security issued an alert on Sept. 4, 2026, about a critical authentication bypass in Citrix NetScaler ADC and NetScaler Gateway after researchers reported attackers probing for it. CISA added the flaw, CVE-2026-19490, to its Known Exploited Vulnerabilities catalogue on Sept. 9.

The bug lets a remote, unauthenticated attacker get around login controls on appliances set up as a gateway for SSL VPN, ICA Proxy, clientless VPN or RDP Proxy, or as an AAA virtual server. Those are the configurations organizations use to let staff reach internal applications from outside.

What happened

Citrix fixed CVE-2026-19490 and a related buffer overflow, CVE-2026-19489, in a security bulletin on Aug. 19. At the time it did not flag either as exploited. NVD rates CVE-2026-19490 at 9.8; Citrix scored it 9.3 under CVSS 4.0. CVE-2026-19489, rated 8.8, can cause memory overflow and denial of service.

After a proof-of-concept exploit appeared online, Ryan Dewhurst of Previdian said one of the company's NetScaler sensors received matching requests on Sept. 3 from three IP addresses, BleepingComputer reported. He cautioned that the requests showed exploitation attempts but did not confirm successful compromises. Belgium's national cyber security centre also warned of attempts. The Shadowserver Foundation tracked more than 22,000 NetScaler ADC appliances online.

The Cyber Centre's alert AL26-019 said appliances on 14.1-43.56 and later, and 13.1-61.28 and later, are vulnerable when configured as a SAML identity provider, while earlier builds with Gateway or AAA configurations are also exposed.

How to check exposure

The Cyber Centre suggested searching the NetScaler configuration for "add authentication samlAction", "add authentication vserver" or "add vpn vserver" for CVE-2026-19490, and "add lsn group" entries with sipalg for CVE-2026-19489.

What to do

• Upgrade to NetScaler ADC and Gateway 14.1-73.32 or 13.1-63.21 or later. FIPS builds need 14.1-73.32 FIPS; FIPS and NDcPP 13.1 builds need 13.1-37.277.
• Treat patching as an emergency for appliances configured as Gateway or AAA virtual servers.
• Monitor authentication logs for unauthorized access, and follow Citrix's compromise guidance if you find signs of intrusion.
• After patching, confirm the new version is running and review logs for unusual activity.