---
title: "NetScaler CVE-2026-19490: Exploited Gateway Auth Bypass"
url: https://erroneo.us/security/briefs/citrix-netscaler-cve-2026-19490-gateway-aaa-auth-bypass/
description: "Unauthenticated auth bypass in NetScaler Gateway/AAA vservers (SAML on newer builds), in CISA KEV. Fixed in 14.1-73.32/13.1-63.21; go to 73.46/64.29 now."
type: security-brief
section: "Security Digest"
date_published: 2026-08-19
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-19490"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# NetScaler CVE-2026-19490: Exploited Gateway Auth Bypass

**Verdict: Act now.** Any customer-managed NetScaler with a Gateway or AAA virtual server on an August-or-older build should be upgraded today, straight to the current builds, because this bypass is being tried in the wild and later exploited NetScaler bugs are fixed in the same upgrade.

- **Who must act:** Teams running NetScaler ADC or Gateway 14.1 before 14.1-73.32, 13.1 before 13.1-63.21 or the FIPS/NDcPP equivalents with a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver, especially with a SAML action configured.
- **Who can relax:** Citrix-managed cloud and Adaptive Authentication customers (patched by the vendor), and ADC deployments with no Gateway or AAA vserver, which are outside this CVE but still need later NetScaler fixes.
- **Affected:** NetScaler ADC and Gateway 14.1 before 14.1-73.32 (14.1-43.56 and later: only with a SAML action plus a Gateway or AAA vserver); NetScaler ADC and Gateway 13.1 before 13.1-63.21 (13.1-61.28 and later: only with a SAML action); NetScaler ADC 14.1 FIPS before 14.1-73.32 FIPS; NetScaler ADC 13.1 FIPS and NDcPP before 13.1-37.277; Secure Private Access hybrid deployments using affected NetScaler instances
- **Fixed:** 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS, 13.1-37.277 FIPS/NDcPP (minimum for CVE-2026-19490); Recommended now: 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, 13.1-37.283 FIPS/NDcPP (also cover the Sept/Oct 2026 bulletins)
- **CVEs:** CVE-2026-19490
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check each appliance's build with show ns version, including HA peers and Secure Private Access hybrid nodes.
2. Check for the vulnerable configuration: grep ns.conf for add authentication samlAction, add authentication vserver and add vpn vserver.
3. Upgrade to 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS or 13.1-37.283 FIPS/NDcPP, which include the CVE-2026-19490 fix and the later September and October fixes.
4. After upgrading, review active AAA sessions and terminate any you cannot account for (kill aaa session -all if you suspect a bypass).
5. Keep the management interface (NSIP) on an admin-only network and forward ns.log and authentication logs to a SIEM.

### How to check if you are affected

- Compare Gateway and AAA logins since early September 2026 with your identity provider's sign-in logs; sessions with no matching IdP authentication are suspect.
- Review SAML authentication events, changes to SAML actions and authentication policies, and admin activity on the appliance.
- If an affected Gateway was internet-facing and unpatched in September, also run the indicator checks for the separate CVE-2026-88771/88772 campaign, which overlaps that window.

## What happened

On August 19, 2026, Cloud Software Group published bulletin [CTX696939](https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html) for CVE-2026-19490, an authentication bypass using an alternate path or channel (CWE-288) in NetScaler ADC and NetScaler Gateway. When the appliance acts as a Gateway (SSL VPN, ICA Proxy, CVPN or RDP Proxy) or as an AAA virtual server, a remote attacker with no credentials may be able to get past authentication. The vendor scores it CVSS 4.0 9.3, and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-19490) adds a CVSS 3.1 score of 9.8. The same bulletin fixes CVE-2026-19489 (CVSS 4.0 8.8), a memory overflow that matters only when SIP ALG is enabled on a Large Scale NAT group. Citrix credits Samarth Vashisht of JPMorgan Chase's pen-test team, lists no workaround, and has not published root-cause details.

Neither Citrix nor [Rapid7](https://rapid7.com/blog/post/etr-cve-2026-19490-critical-vulnerability-affecting-citrix-netscaler-adc-and-netscaler-gateway) had seen exploitation at release. According to [SecurityWeek](https://www.securityweek.com/critical-netscaler-vulnerability-exploited-in-attacks/), an exploit appeared on GitHub around September 2. Previdian founder Ryan Dewhurst told [BleepingComputer](https://bleepingcomputer.com/news/security/hackers-target-critical-citrix-netscaler-auth-bypass-in-attacks) that on September 3 one of its NetScaler sensors received requests matching the proof of concept from three source IPs, and cautioned that this "does not confirm successful compromise." [The Hacker News](https://thehackernews.com/2026/08/critical-netscaler-flaw-can-bypass.html) later cited 10 attempts from six IPs in Australia, Germany, Japan and the U.S. Belgium's CCB and Singapore's [CSA](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-115/) issued warnings, and CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19490) on September 9 with a three-day deadline. [Field Effect](https://fieldeffect.com/blog/early-exploitation-citrix-netscaler-vulnerability) notes that successful exploitation may give access to applications and services protected by NetScaler authentication.

## Who is affected

Customer-managed NetScaler ADC and Gateway 14.1 before 14.1-73.32, 13.1 before 13.1-63.21, 14.1 FIPS before 14.1-73.32 FIPS and 13.1 FIPS/NDcPP before 13.1-37.277, plus Secure Private Access hybrid deployments that use those instances. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-19490) lists the same ranges. Whether a box is exposed depends on its build:

- 14.1-43.56 and later (and 14.1-66.68-FIPS and later): a Gateway or AAA vserver **and** a SAML action.
- 14.1-43.55 and earlier, 13.1-61.27 and earlier, and 13.1 FIPS: any Gateway or AAA vserver.
- 13.1-61.28 and later: only with a SAML action.

Citrix-managed cloud services and Adaptive Authentication are updated by the vendor. Shadowserver data cited by BleepingComputer counted more than 22,000 internet-facing NetScaler ADC and nearly 1,700 Gateway instances in early September, without saying how many were vulnerable.

## Do you really need to act?

If you run a Gateway or AAA vserver on an affected build, yes, today. This is an unauthenticated bypass on the box whose whole job is authenticating remote users. CISA rates it automatable with total technical impact, and NetScaler bugs have a long record of fast, broad exploitation. The SAML condition narrows exposure on newer builds, but SAML sign-in through an external identity provider is common on Gateways, so check the config.

The public evidence is of exploitation attempts, not confirmed breaches, and the fix has been out for two months. But any appliance still on an August build is also missing the September 27 fixes in [CTX697096](https://support.citrix.com/external/article/CTX697096) for CVE-2026-88771 and CVE-2026-88772, which Citrix says were exploited, the October 3 SAML fix in [CTX697174](https://support.citrix.com/external/article/CTX697174), and the October 8 fix in [CTX697191](https://support.citrix.com/external/article/CTX697191/citrix-netscaler-adc-and-netscale.html) for CVE-2026-107406, a CVSS 9.5 memory overflow in SAML SP/IdP setups. The first two have their own brief. Upgrading straight to the current builds closes all of them at once.

ADC deployments that only load-balance, with no Gateway or AAA vserver, are not exposed to CVE-2026-19490, and on recent builds neither are Gateways without a SAML action. They still need the later fixes.

## What to do now

1. Check each appliance's build: `show ns version`. Include HA peers and Secure Private Access hybrid nodes.
2. Check for the vulnerable configuration: `shell grep -E "add authentication samlAction|add authentication vserver|add vpn vserver" /nsconfig/ns.conf`.
3. Upgrade to 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS or 13.1-37.283 FIPS/NDcPP. The minimum for this CVE alone is 14.1-73.32, 13.1-63.21 or 13.1-37.277.
4. After upgrading, list sessions with `show aaa session` and terminate any you cannot account for, or run `kill aaa session -all` if you suspect a bypass. Citrix does not require this for this CVE; it is a precaution.
5. Keep the management interface (NSIP) on an admin-only network and forward `ns.log` and authentication logs to a SIEM.

## How to tell if you were hit

Citrix has published no indicators for this CVE, and Previdian has not released the source IPs it saw. Hunt by behavior, as Field Effect suggests. Compare Gateway and AAA logins and sessions since early September with your identity provider's sign-in logs, and treat sessions with no matching IdP authentication as suspect, especially SAML logins for users who did not sign in. Review changes to SAML actions and authentication policies and any admin activity you cannot explain. If an affected Gateway was internet-facing and unpatched in September, also run the indicator checks for the separate CVE-2026-88771/88772 campaign, which overlaps that window.

## Timeline

- Aug 19, 2026 — Citrix publishes CTX696939 with fixed builds; the CVE is published. Rapid7 reports no observed exploitation.
- Sep 2, 2026 — An exploit is published on GitHub, per SecurityWeek.
- Sep 3, 2026 — Previdian sensors receive requests matching the public PoC.
- Sep 7, 2026 — Singapore's CSA warns of active exploitation.
- Sep 9, 2026 — CISA adds CVE-2026-19490 to KEV.
- Sep 12, 2026 — CISA's remediation deadline for federal agencies.
- Sep 27, 2026 — Citrix publishes CTX697096 (exploited CVE-2026-88771/88772), raising the minimum builds.
- Oct 3, 2026 — Citrix publishes CTX697174 (SAML, CVE-2026-88779).
- Oct 8, 2026 — Citrix publishes CTX697191 (CVE-2026-107406); the newest fixed builds are 14.1-73.46 and 13.1-64.29.

## Sources

1. [Citrix — NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19489 and CVE-2026-19490 (CTX696939)](https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html)
2. [CVE record — CVE-2026-19490](https://www.cve.org/CVERecord?id=CVE-2026-19490)
3. [NVD — CVE-2026-19490](https://nvd.nist.gov/vuln/detail/CVE-2026-19490)
4. [CISA — Known Exploited Vulnerabilities: CVE-2026-19490](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19490)
5. [Citrix — Security Bulletin for CVE-2026-88771 through CVE-2026-88778 (CTX697096)](https://support.citrix.com/external/article/CTX697096)
6. [Citrix — Security Bulletin for CVE-2026-88779 (CTX697174)](https://support.citrix.com/external/article/CTX697174)
7. [Citrix — Security Bulletin for CVE-2026-107406 (CTX697191)](https://support.citrix.com/external/article/CTX697191/citrix-netscaler-adc-and-netscale.html)
8. [Rapid7 — CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway](https://rapid7.com/blog/post/etr-cve-2026-19490-critical-vulnerability-affecting-citrix-netscaler-adc-and-netscaler-gateway)
9. [CSA Singapore — Active Exploitation of Vulnerability in NetScaler ADC and NetScaler Gateway (AL-2026-115)](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-115/)
10. [Field Effect — Early exploitation of Citrix NetScaler authentication bypass vulnerability](https://fieldeffect.com/blog/early-exploitation-citrix-netscaler-vulnerability)
11. [BleepingComputer — Critical Citrix NetScaler auth bypass now leveraged in attacks](https://bleepingcomputer.com/news/security/hackers-target-critical-citrix-netscaler-auth-bypass-in-attacks)
12. [SecurityWeek — Critical NetScaler Vulnerability Exploited in Attacks](https://www.securityweek.com/critical-netscaler-vulnerability-exploited-in-attacks/)
13. [The Hacker News — Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers](https://thehackernews.com/2026/08/critical-netscaler-flaw-can-bypass.html)

---
Source page: https://erroneo.us/security/briefs/citrix-netscaler-cve-2026-19490-gateway-aaa-auth-bypass/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt