CVE-2026-19490 Exploited in the wild

Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

Risk score: 83/100
CVSS: Not Scored
Added to CISA's exploited list: 9 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass au…
Affected: Citrix Netscaler
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: Exploited in the wild

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Citrix Netscaler: Red, act today. A vulnerability in Citrix NetScaler ADC and Gateway allows an attacker to execute code remotely or cause a denial of service. An attacker could exploit this vulnerability to gain high impact.

The flaws

CVE-2026-19490: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability (exploited)
CVE-2026-88772: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVSS 8.1 · EPSS 5% · exploited)
CVE-2026-88771: Citrix NetScaler Improper Input Validation Vulnerability (CVSS 9.8 · EPSS 5% · exploited)
CVE-2026-88779: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVSS 7.5 · EPSS 1% · exploited)

The fix

Upgrade Citrix Netscaler: 14.1 · 13.1 · 13.1.37.279 or later on your release line

Who is exposed: {'products': ['Citrix NetScaler ADC', 'Citrix NetScaler Gateway'], 'packages': [], 'versions': ['before 14.1-73.37', 'before 13.1-64.23', 'before 14.1-73.37 FIPS', 'before 13.1.37.279 FIPS and NDcPP']}

Where it stands

Exploited in the wild
On CISA's exploited list since 9 Sep
US federal deadline 12 Sep

How it unfolded

9 Sep, CISA (official): Added to the Known Exploited Vulnerabilities list (4 of these flaws)
12 Sep, Deadline (official): US federal agencies must have patched

Connects to

Same weakness: Authentication bypass (CWE-288). 33 other warnings in 30 days

Why it is Red

Not yet scored by NVD
Exploited in the wild (CISA KEV)
On your watchlist: citrix

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Original description

Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.

Last activity 9 Sep 2026. Patch Forecast updates every hour.