Attackers have begun exploiting a critical authentication bypass vulnerability in Citrix NetScaler appliances, identified as CVE-2026-19490. The flaw allows unprivileged remote attackers to bypass authentication when the NetScaler appliance is configured as a AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy). The specific impact depends on the NetScaler firmware version and whether SAML Action is configured.
Citrix issued a security bulletin in mid-August addressing the vulnerability and strongly recommended that customers review the advisory, assess their deployments, and upgrade affected appliances to the recommended builds promptly. However, as of its August 19 advisory, Citrix had not yet confirmed active exploitation.
Previdian, a vulnerability intelligence company, reported that exploitation attempts targeting CVE-2026-19490 began after a credible proof-of-concept (PoC) exploit was published online. On September 3, Previdian's NetScaler sensors recorded requests matching the PoC from three distinct IP addresses located in Australia, the United States, and Germany. Previdian's assessment indicates these are exploitation attempts, though they do not confirm successful compromise of real-world systems.
The Centre for Cybersecurity Belgium (NCC-BE) also issued a warning on Friday, urging administrators to prioritize patching all vulnerable Citrix NetScaler appliances within their organizations due to observed exploitation attempts.
Internet threat watchdog Shadowserver tracks over 22,000 NetScaler ADC appliances and nearly 1,700 Gateway instances exposed online. However, it is unclear how many of these are honeypots, have vulnerable configurations, or have already been patched against CVE-2026-19490.
This is not the first time Citrix NetScaler flaws have been quickly exploited. In March, Citrix urged administrators to patch two other NetScaler vulnerabilities, CVE-2026-3055 and CVE-2026-4368, just days before they were leveraged in attacks. The Cybersecurity and Infrastructure Security Agency (CISA) subsequently added CVE-2026-3055 to its catalog of actively exploited vulnerabilities and mandated federal agencies patch vulnerable Citrix appliances within three days.
Since November 2021, CISA has identified 23 Citrix vulnerabilities as exploited in the wild, with six of these also being abused by ransomware groups.
