CVE-2026-19490

Published Aug 19, 2026

Last updated 6 hours ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-19490 is an authentication bypass vulnerability impacting Citrix NetScaler ADC and NetScaler Gateway appliances. This flaw, classified as CWE-288: Authentication Bypass Using an Alternate Path, allows an unauthenticated remote attacker to circumvent authentication controls on vulnerable systems. The vulnerability specifically affects appliances configured as a Gateway (such as SSL VPN, ICA Proxy, Clientless VPN/CVPN, or RDP Proxy) or as an AAA virtual server. For newer vulnerable builds, exploitation may require a SAML action to be configured, while older builds have a broader attack surface where the Gateway or AAA configuration alone is sufficient. Successful exploitation of CVE-2026-19490 could grant an attacker unauthorized access to internal applications and services that are typically secured behind authentication boundaries, without needing valid credentials or user interaction. The affected versions include NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.32, and 13.1 before 13.1-63.21, along with corresponding FIPS and NDcPP releases. Cloud Software Group, the vendor, has released security updates and strongly recommends that customers upgrade affected customer-managed NetScaler appliances immediately.

Description: Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.
Source: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5
NVD status: Undergoing Analysis

Risk scores

CVSS 4.0

Type: Secondary
Base score: 9.3
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
Exploit added on: Sep 9, 2026
Exploit action due: Sep 12, 2026
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-288

Hype score: Not currently trending

References

Sources include official advisories and independent security research.