Citrix NetScaler Bug Lets Attackers Skip Login Entirely

An unauthenticated attacker who can reach a NetScaler ADC or Gateway appliance configured as an SSL VPN, an AAA virtual server, or an ICA, CVPN or RDP proxy can bypass its login entirely. Citrix patched the flaw, CVE-2026-19490, on Aug. 19, and the Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog three weeks later, on Sept. 9, citing active exploitation.

Cloud Software Group, which owns Citrix, rates the bug 9.3 out of 10 under CVSS 4.0 and tracks it as CWE-288, authentication bypass using an alternate path. The company credited Samarth Vashisht, from the penetration-testing team at JPMorgan Chase, with reporting it. A second, unrelated flaw in the same bulletin, CVE-2026-19489, is a memory overflow that can crash an appliance running SIP ALG on a Large Scale NAT configuration, rated 8.8.

Three weeks from patch to public exploit code

• Aug. 19: Citrix ships fixed builds. Rapid7 says it has not observed exploitation.
• Aug. 20: Rapid7 publishes a check customers can run to see if their appliance is exposed.
• Sept. 2: proof-of-concept exploit code appears on GitHub.
• Sept. 3: exploitation begins. Previdian, a threat-intelligence firm, says its sensors logged matching requests from three IP addresses in three countries within a day of the code's release.
• Sept. 9: CISA lists CVE-2026-19490 as actively exploited. Rapid7 updates its own guidance from routine to urgent.

Ryan Dewhurst, Previdian's founder and a former head of threat intelligence at watchTowr, said the requests his firm's sensors caught were consistent with attackers testing the public exploit rather than one coordinated campaign. Rapid7's own language shifted over the same three weeks: on Aug. 19 it wrote that it "has not observed evidence that CVE-2026-19490 is being exploited in the wild," and by Sept. 11 it was telling customers to "remediate these issues on an urgent basis," outside normal patch cycles.

The score doesn't overstate the risk, but its preconditions do the real work

A 9.3 rating with no authentication and no user interaction sounds like every NetScaler box on the internet is exposed, and that is not quite true. The bypass only applies to an appliance configured as a Gateway, covering SSL VPN, ICA proxy, CVPN or RDP proxy, or as an AAA virtual server, and whether it is reachable also depends on the firmware branch and whether a SAML action is configured at all. A NetScaler doing pure load balancing, with no VPN or authentication role assigned, is not exposed by this bug. That distinction matters for triage, not for urgency: an appliance that does fit the precondition needs the patch now, because the precondition describes exactly how most organizations deploy NetScaler in the first place.

CVE	Type	CVSS v4.0	Precondition
CVE-2026-19489	Memory overflow (DoS)	8.8	SIP ALG enabled on a Large Scale NAT configuration
CVE-2026-19490	Authentication bypass	9.3	Configured as a Gateway or AAA virtual server

Fixed versions are NetScaler ADC and Gateway 14.1-73.32 and later, 13.1-63.21 and later, and the matching FIPS builds, 14.1-73.32 FIPS and 13.1-37.277 FIPS/NDcPP. Citrix's bulletin does not say how many appliances remain unpatched, and neither Rapid7 nor Previdian has published a device count the way researchers did for a Cisco firewall bug exploited this month. Administrators who cannot patch immediately should restrict management access to trusted networks and check authentication logs for the same red flag MikroTik router owners were told to look for after a comparable bypass chain: a successful login with no matching failed attempt beforehand.