www.it-connect.fr
Citrix NetScaler CVE-2026-19490 Lets Attackers Bypass Authentication
On August 19, 2026, Citrix released a new security bulletin for NetScaler ADC and NetScaler Gateway. It refers to two security flaws, including one that is particularly concerning: CVE-2026-19490. I’m telling you this because it allows a remote, unauthenticated attacker to bypass authentication. No exploitation has been observed so far, but we all know how this usually ends with Citrix appliances...
Citrix again? Yes, again. For the past three years, NetScaler ADC and NetScaler Gateway appliances have been hit by one critical bulletin after another: CitrixBleed, exploited by the LockBit ransomware gang in late 2023, CitrixBleed 2 and its 56,000 exposed instances in June 2025, the CVE-2025-7775 zero-day already exploited in attacks in August 2025, and then the CVE-2026-3055 and CVE-2026-4368 vulnerabilities last March. I may have missed a few, but one thing is certain: the August 2026 bulletin adds to that list.
CVE-2026-19490: an authentication bypass
The CVE-2026-19490 security flaw makes it possible to bypass authentication: no account or password needs to be stolen, since the authentication mechanism itself is bypassed. No user interaction is required, with the main condition being access to the Citrix NetScaler login interface.
That said, it is still worth noting that exploitation is possible only if the following prerequisite is met. The instance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. After that, everything depends on the installed version:
- Versions 14.1-43.56 and later: vulnerable only if a SAML action is configured, in addition to a Gateway configuration or an AAA vserver.
- Versions 14.1-66.68-FIPS and later: same condition.
- Versions 14.1-43.55 and earlier: a Gateway configuration or an AAA vserver is enough.
- Versions 13.1-61.28 and later: vulnerable only when a SAML action is present.
- Versions 13.1-61.27 and earlier: a Gateway configuration or an AAA vserver is enough.
- Versions 13.1 FIPS: a Gateway configuration or an AAA vserver is enough.
You’ll need to check which version you are running to determine how exposed you are to this new flaw.
Also worth mentioning is the second security issue patched at the same time by Citrix’s teams: CVE-2026-19489, a memory overflow with a CVSS score of 8.8 out of 10. It can cause a denial of service on the Citrix NetScaler instance, but only if the SIP ALG feature is enabled on an LSN group configuration.
Affected versions, fixes, and checks to perform
According to Citrix’s security bulletin, here is the list of vulnerable versions:
- NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.32
- NetScaler ADC and NetScaler Gateway 13.1 before 13.1-63.21
- NetScaler ADC FIPS before 14.1-73.32 FIPS
- NetScaler ADC FIPS and NDcPP before 13.1-37.277
In other words, the security patches are included in these versions: 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS and 13.1-37.277. Installing the update is the only viable solution, because there is no workaround (unless you change the configuration).
To find out whether you are exposed, Citrix recommends inspecting the appliance configuration. For CVE-2026-19490, look for add authentication samlAction.* (SAML action), as well as add authentication vserver .* and add vpn vserver .* (authentication or VPN virtual server). For CVE-2026-19489, look for add lsn group.*sipalg.*. All of this is explained in the security bulletin, if needed.
As of August 19, 2026, Rapid7 had not observed any evidence of exploitation of CVE-2026-19490. "However, organizations should prioritize and urgently apply patches to affected systems, as Citrix products are prime targets that are often attacked in the wild very quickly.", the company said.
There are plenty of examples, as I mentioned in the introduction. This is even more true when thousands of instances are directly exposed on the Web...
