Citrix NetScaler Authentication Bypass: The 9.3 Severity Flaw
Citrix has rolled out patches for two vulnerabilities in its NetScaler ADC and NetScaler Gateway products. The more serious of the two, tracked as CVE-2026-19490, carries a CVSS score of 9.3 and is described as an authentication bypass using an alternative path.
This Citrix NetScaler authentication bypass impacts appliances configured as a gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server. The worst part? It can be exploited by remote, unauthenticated attackers without any user interaction, according to cybersecurity firm Rapid7.
Which NetScaler Versions Are Vulnerable?
Per Citrix’s advisory, the security defect impacts a wide range of NetScaler ADC and NetScaler Gateway versions. The list includes 14.1-43.56 or later, 14.1-66.68-FIPS or later, 14.1-43.55 or earlier, 13.1-61.28 or later, 13.1-61.27 or earlier, and 13.1 FIPS.
If you’re running any of these, you need to act. The fixed versions are:
- 14.1-73.32
- 13.1-63.21
- 14.1-73.32 FIPS
- 13.1-FIPS and 13.1-NDcPP 13.1-37.277
These builds also contain fixes for CVE-2026-19489, a high-severity memory overflow issue. That one could lead to unexpected behavior or denial-of-service (DoS) if SIP ALG is enabled at an LSN group configuration.
Secure Private Access Hybrid Deployments Also Affected
Citrix notes that Secure Private Access Hybrid deployments using NetScaler instances are also affected by these vulnerabilities. Customers need to upgrade these NetScaler instances to the recommended builds to address the issues.
Why Experts Expect Quick Exploitation
Rapid7 says there are currently no indicators that threat actors are exploiting the authentication bypass issue. But that’s likely to change. NetScaler’s critical role within enterprise systems makes it an attractive target for hackers.
The firm points out that NetScaler ADC and NetScaler Gateway are widely deployed enterprise networking products commonly positioned at or near the network perimeter. NetScaler ADC provides application delivery, traffic management, load balancing, SSL/TLS offloading, and application security capabilities, while NetScaler Gateway provides secure remote access and VPN functionality.
Given that NetScaler appliances are typically deployed in enterprise DMZs and are publicly accessible, Rapid7 expects threat actors to exploit the critical bug shortly. The company’s advice is blunt: organizations should prioritize patching affected systems on an emergency basis, since Citrix products are high-value targets that tend to quickly see exploitation in the wild.
This isn’t the first time Citrix NetScaler has been in the spotlight for security issues. Past incidents have shown that attackers move fast when it comes to these devices. For a broader look at how similar flaws have played out, check out our coverage of the critical GitLab flaw exploited shortly after disclosure and the previous Citrix NetScaler HTTP/2 bomb attack.
What Should Organizations Do Now?
The message from security researchers is clear: don’t wait. If your organization uses Citrix NetScaler ADC or Gateway, verify your version and apply the patches immediately. The authentication bypass issue is too dangerous to leave unaddressed, especially given the public accessibility of these devices.
For those who need more context on how similar vulnerabilities have been handled, our article on the exploitation of a fresh Citrix NetScaler vulnerability offers useful background on the threat landscape surrounding these products.
Stay ahead of the curve by keeping your NetScaler deployments up to date and monitoring Citrix’s security advisories regularly. The window for safe patching may be smaller than you think.
