A login screen that can be walked around
Citrix's NetScaler ADC and NetScaler Gateway appliances sit at the front door of thousands of corporate networks, handling SSL VPN, ICA Proxy, CVPN and RDP Proxy connections. A flaw in that front door, tracked as CVE-2026-19490, lets an attacker reach the inside without ever supplying valid credentials. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog on September 9, and ordered federal civilian agencies to patch or mitigate it by September 12.
The bug carries a CVSS (Common Vulnerability Scoring System) rating of 9.3 out of 10. According to Citrix's own advisory, it affects appliances configured as a Gateway or as an AAA (Authentication, Authorization and Auditing) virtual server, and it works by abusing the SAML (Security Assertion Markup Language) HTTP-Redirect binding, one of the paths NetScaler uses to hand off login to an external identity provider, to slip past the authentication check entirely.
Where the exposure actually is
Not every NetScaler deployment is exposed. The flaw only applies to appliances acting as a Gateway, covering SSL VPN, ICA Proxy, Citrix VPN (CVPN) or RDP Proxy service, or configured as an AAA virtual server. Both of those roles are common on internet-facing boxes, which is exactly why the flaw matters: a NetScaler doing nothing but internal load balancing is not in scope, but one brokering remote access for staff almost certainly is.
Citrix disclosed the issue alongside a second, lower-severity bug, CVE-2026-19489, an 8.8-rated memory overflow that can crash or destabilize an appliance, but only when SIP (Session Initiation Protocol) ALG is enabled on a Large Scale NAT group, a narrower and less common configuration.
The exploitation timeline
Citrix first published both advisories on August 19, with no workaround offered beyond upgrading. A working proof-of-concept exploit for CVE-2026-19490 began circulating publicly in early September, and security researchers tracking honeypot systems recorded the first real attack traffic on September 3. Activity has climbed since: Security Affairs reported 56 separate exploitation attempts against monitored honeypots between September 3 and September 8, with 36 of those, roughly two-thirds of the total, landing on September 8 alone.
CISA's September 9 catalog update bundled CVE-2026-19490 with two other actively exploited flaws it added the same day: a maximum-severity (CVSS 10.0) authentication bypass in Cisco's Secure Firewall Management Center web interface, CVE-2026-20079, which lets an unauthenticated attacker run scripts and reach root and has been exploited since August, and a Fortinet FortiOS heap-based buffer overflow, CVE-2025-25249, which attackers have used since July to deliver a remote access trojan tracked as PivotC2, with roughly 3,000 IP addresses targeted and 178 devices confirmed infected. All three now carry the same September 12 deadline for US federal civilian agencies, meaning three separate edge-device vendors had actively exploited, unauthenticated-access flaws land in the same weekly batch.
Fixed versions
Citrix's remediation is a straight version upgrade, not a configuration change:
| Branch | Vulnerable | Fixed |
|---|---|---|
| NetScaler ADC/Gateway 14.1 | before 14.1-73.32 | 14.1-73.32 or later |
| NetScaler ADC/Gateway 13.1 | before 13.1-63.21 | 13.1-63.21 or later |
| NetScaler ADC FIPS/NDcPP 14.1 | before 14.1-73.32 FIPS | 14.1-73.32 FIPS or later |
| NetScaler ADC FIPS/NDcPP 13.1 | before 13.1-37.277 | 13.1-37.277 or later |
Versions that have already reached end of life do not get a fix and need to be replaced or isolated, not patched. Citrix's advisory lists no interim workaround for CVE-2026-19490, such as a configuration flag or access-control-list rule, which is what makes the upgrade path the only real remediation rather than one option among several.
What this means in practice
Federal agencies have a hard deadline, but the underlying exposure is identical for everyone else running an internet-facing NetScaler Gateway or AAA virtual server: the combination of a public proof-of-concept, no workaround, and confirmed in-the-wild scanning means patching is the only real option, and waiting increases the odds of being one of the next attempts logged. Organizations that cannot upgrade immediately should at minimum check appliance logs for unexpected authentication events and treat any NetScaler exposed to the internet as a priority even if it has not shown signs of compromise yet. Because the bug lives in the SAML handoff rather than in a rarely used feature, any organization using NetScaler for federated single sign-on into its VPN is a plausible target regardless of size or sector, which is a different risk profile from a flaw buried in an optional module.
