Citrix has issued an urgent security advisory concerning CVE-2026-19490, a critical authentication bypass vulnerability affecting its NetScaler ADC and NetScaler Gateway products. The flaw, which carries a CVSS v4.0 base score of 9.3, allows an unauthenticated attacker to remotely exploit affected systems over a network without requiring user interaction or elevated privileges.
The vulnerability impacts several versions of NetScaler ADC and NetScaler Gateway, which are widely deployed enterprise networking solutions often positioned at the network perimeter. These products provide essential services such as application delivery, load balancing, SSL/TLS offloading, and secure remote access via VPN functionality. Given their common exposure to the public internet in enterprise DMZs, authentication bypass vulnerabilities in Citrix products are considered high-value targets for threat actors.
Specifically, the following versions are affected: NetScaler ADC and NetScaler Gateway 14.1 prior to version 14.1-73.32; NetScaler ADC and NetScaler Gateway 13.1 prior to version 13.1-63.21; NetScaler ADC FIPS prior to version 14.1-73.32 FIPS; and NetScaler ADC FIPS and NDcPP prior to version 13.1-37.277.
Citrix has released patches to address the vulnerability. Customers are advised to update to NetScaler ADC and NetScaler Gateway 14.1-73.32 or later, NetScaler ADC and NetScaler Gateway 13.1-63.21 or later, NetScaler ADC 14.1-FIPS 14.1-73.32 FIPS or later, and NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.277 or later.
To determine if their systems are vulnerable, Citrix advises customers to inspect their NetScaler configuration for specific entries. The presence of a SAML action configuration (e.g., `add authentication samlAction.*`) or a configured Auth or VPN vserver (e.g., `add authentication vserver .*` or `add vpn vserver .*`) on an affected version indicates potential exploitability.
As of August 19, 2026, there is no confirmed evidence of CVE-2026-19490 being exploited in the wild. However, cybersecurity experts emphasize the critical importance of immediately applying the necessary updates due to the historical pattern of rapid exploitation for similar vulnerabilities in Citrix products. Organizations are urged to prioritize patching on an emergency basis.
