Cloud Software Group shipped emergency patches on August 19 for CVE-2026-19490, a critical authentication bypass in NetScaler ADC and NetScaler Gateway that lets a remote, unauthenticated attacker reach resources protected behind the appliance without ever presenting valid credentials. This is the third major NetScaler authentication/session flaw disclosed in 2026 following the CitrixBleed-pattern memory overreads (CVE-2026-3055, CVE-2026-8451), and it hits a different part of the stack: instead of leaking a session token to replay, this bug walks straight around the authentication check.

What’s vulnerable

CVE-2026-19490 carries a CVSS v4.0 base score of 9.3 and is classified as CWE-288 (Authentication Bypass Using an Alternate Path). It affects NetScaler appliances configured as a Gateway — for SSL VPN, ICA Proxy, CVPN, or RDP Proxy — or as an AAA virtual server, which covers the overwhelming majority of production NetScaler deployments, since those are the appliance’s core use cases as an enterprise remote-access and SSO front end.

Exploitability depends on build and configuration:

  • On NetScaler 14.1-43.56 and later, and 13.1-61.28 and later, the flaw is only reachable when the appliance has a SAML action configured.
  • On earlier builds, any Gateway or AAA vserver configuration is sufficient — no SAML requirement — which broadens the exposed population considerably for organizations running older code.

No authentication, user interaction, or elevated privileges are required to trigger the bypass, and it’s remotely exploitable over the network — the profile that has made every prior NetScaler authentication-layer bug a fast target for mass scanning.

Patched versions

Cloud Software Group’s advisory (CTX696939) lists the following fixed builds:

  • NetScaler ADC and NetScaler Gateway 14.1-73.32 and later
  • NetScaler ADC and NetScaler Gateway 13.1-63.21 and later
  • NetScaler ADC 14.1-FIPS 14.1-73.32-FIPS and later
  • NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.277 and later

Any earlier build on the 14.1 or 13.1 lines is affected. There is no workaround short of upgrading — Citrix is not offering a config-based mitigation for this one, given that the bypass targets the authentication path itself rather than a specific feature flag you can disable.

Impact

NetScaler sits at the network edge by design, terminating VPN and SSO traffic before it reaches internal resources. An authentication bypass at that layer means an attacker can walk directly to whatever the appliance was gatekeeping — internal web apps, RDP targets proxied through the Gateway, or backend services trusting the AAA vserver’s authentication decision — without needing a phished password, a leaked token, or an MFA bypass. That’s a materially different (and in some ways worse) primitive than the CitrixBleed-style memory leaks earlier this year, which still required an attacker to capture and replay a token. Here, there’s nothing to steal; the check simply doesn’t hold.

As with every prior NetScaler edge-auth vulnerability this year, expect this to move fast. Citrix products sitting in enterprise DMZs are a standing target for opportunistic scanning the moment a CVE and patch delta are public, and CitrixBleed-lineage bugs have repeatedly seen in-the-wild exploitation within 24 hours of disclosure — well ahead of CISA KEV listing. Rapid7 had not observed confirmed exploitation as of the advisory’s publication, but that is not a reason to delay patching.

What to do now

  • Patch immediately to 14.1-73.32 / 13.1-63.21 or later (or the corresponding FIPS/NDcPP builds). Treat this as an emergency-change window, not a routine maintenance cycle.
  • Inventory your Gateway and AAA vserver configs — any appliance running SSL VPN, ICA Proxy, CVPN, RDP Proxy, or a standalone AAA vserver is in scope. Check whether a SAML action is configured to understand which exploitation path applies to your build.
  • Assume broader exposure on older builds. If you’re running anything prior to 14.1-43.56 or 13.1-61.28, the SAML precondition doesn’t apply to you — any Gateway/AAA config is enough to be exposed.
  • Review access logs post-patch for anomalous authentication events or session establishment that doesn’t correlate with a normal login flow, since a bypass leaves a different forensic signature than a credential-based compromise.
  • Don’t wait for KEV. Given the track record of NetScaler auth-layer bugs this year, treat the CTX696939 advisory date as the deadline.

Advisory: Citrix CTX696939. Additional analysis: Rapid7, eSecurity Planet.