NetScaler CVE-2026-19490: Exploited Gateway Auth Bypass
Any customer-managed NetScaler with a Gateway or AAA virtual server on an August-or-older build should be upgraded today, straight to the current builds, because this bypass is being tried in the wild and later exploited NetScaler bugs are fixed in the same upgrade.
Must act: Teams running NetScaler ADC or Gateway 14.1 before 14.1-73.32, 13.1 before 13.1-63.21 or the FIPS/NDcPP equivalents with a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver, especially with a SAML action configured.
Can relax: Citrix-managed cloud and Adaptive Authentication customers (patched by the vendor), and ADC deployments with no Gateway or AAA vserver, which are outside this CVE but still need later NetScaler fixes.
- Check each appliance's build with show ns version, including HA peers and Secure Private Access hybrid nodes.
- Check for the vulnerable configuration: grep ns.conf for add authentication samlAction, add authentication vserver and add vpn vserver.
- Upgrade to 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS or 13.1-37.283 FIPS/NDcPP, which include the CVE-2026-19490 fix and the later September and October fixes.