CVE-2026-19490

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-19490 9.1

Citrix · NetScaler · Added 2026-09-09 · Published 2026-08-19

3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityCitrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

VendorCitrix

ProductNetScaler

Date added2026-09-09

Due date2026-09-12

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-288

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Descriptions

KEV: Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.

NVD: Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-09-09 20:10 UTC

Searches6

Component defaultunknown

Sources https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html
https://www.rapid7.com/blog/post/etr-cve-2026-19490-critical-vulnerability-affecting-citrix-netscaler-adc-and-netscaler-gateway/
https://www.securityweek.com/exploitation-expected-for-critical-authentication-bypass-patched-in-citrix-netscaler/
https://www.helpnetsecurity.com/2026/08/21/citrix-netscaler-gateway-cve-2026-19490/
https://socprime.com/blog/cve-2026-19490-analysis/
https://beazley.security/alerts-advisories/critical-vulnerability-in-citrix-netscaler-adc-and-gateway-cve-2026-19490
https://cert.europa.eu/publications/security-advisories/2026-010/
https://www.tenable.com/cve/CVE-2026-19490

Hunting hypothesis agent

Hunt NetScaler Gateway and AAA vserver logs for sessions without a matching SAML or credential login. Look for unauthenticated requests to /vpn/index.html or auth vserver endpoints creating sessions from new IPs or geolocations.

Research details

ComponentSAML authentication alternate path in Gateway/AAA virtual server

PreconditionsAppliance must run a vulnerable version (14.1 before 14.1-73.32 or 13.1 before 13.1-63.21) and be configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. On builds 14.1-43.56+ and 13.1-61.28+, a SAML action must also be configured; earlier builds are vulnerable with Gateway/AAA alone. No authentication or user interaction required. agent

DeliveryNetwork request to Gateway/AAA virtual server authentication endpoint via alternate path

Public PoCno

Advisoryhttps://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html

Exploit notesTenable classifies CVE-2026-19490 as a Vulnerability of Interest, noting exploitation observed and exploit code available as of September 2026. No public PoC repository was identified. Exploitation uses an alternate authentication path (CWE-288) requiring only network access; no privileges or user interaction needed. NetScaler Gateway appliances are typically internet-facing, making exploitation straightforward once techniques circulate.

SummaryCitrix NetScaler ADC and Gateway suffer a critical (CVSS 9.3) authentication bypass via an alternate path in the SAML/Gateway authentication flow. The vulnerability allows unauthenticated remote attackers to bypass login on appliances configured as Gateway or AAA virtual servers. Citrix has released patched builds; no workarounds exist. Rapid7 expects imminent exploitation given the products' DMZ deployment pattern.

Tia coverage

First reported2025-08-26

First exploit report2026-09-04

Exploit report → KEV5 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-kev-update-september-9-2026 citrix-netscaler-unpatched-rce-zero-days citrix-security-advisory-av26-833

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.