Full Report
Attackers have begun targeting a critical-severity Citrix NetScaler auth bypass flaw (CVE-2026-19490) in the wild, according to vulnerability intelligence company Previdian. [...]
Analysis Summary
# Vulnerability: Citrix NetScaler Critical Authentication Bypass
## CVE Details
- **CVE ID:** CVE-2026-19490
- **CVSS Score:** 9.8 (Critical)
- **CWE:** Improper Authentication (Likely CWE-287 based on description)
## Affected Systems
- **Products:** NetScaler ADC and NetScaler Gateway
- **Versions:** Impacted firmware versions include various builds across versions 12.1, 13.0, 13.1, and 14.1 (Refer to official Citrix bulletin for full build list).
- **Configurations:** Systems are vulnerable when configured as:
- AAA Virtual Server
- Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy)
- **Note:** Vulnerability depends on firmware version and whether **SAML Action** is configured.
## Vulnerability Description
CVE-2026-19490 is a critical authentication bypass vulnerability that allows an unprivileged remote attacker to bypass authentication protocols on Citrix NetScaler appliances. The flaw is linked to the processing of authentication requests in specific configurations (AAA and Gateway modes). Successful exploitation provides the attacker with unauthorized access to the network resources protected by the appliance.
## Exploitation
- **Status:** Exploited in the wild.
- **Complexity:** Low (Credible PoC is publicly available).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Full access to internal resources and user data).
- **Integrity:** High (Ability to modify configurations or bypass security controls).
- **Availability:** High (Potential for system takeover or service disruption).
## Remediation
### Patches
Citrix has released updated builds to address this vulnerability. Administrators should upgrade to the following versions or higher:
- NetScaler ADC and NetScaler Gateway 14.1-29.63 and later
- NetScaler ADC and NetScaler Gateway 13.1-53.17 and later
- NetScaler ADC and NetScaler Gateway 13.0-92.31 and later
- NetScaler ADC 12.1-65.44 and later (Note: 12.1 is End of Life; users are urged to migrate).
### Workarounds
There are no official manual workarounds that replace the security of the patch. Immediate upgrade to the recommended builds is the only verified mitigation.
## Detection
- **Indicators of Compromise:** Monitor logs for unusual requests matching public PoC patterns (specifically targeting AAA/Gateway endpoints).
- **Detection methods and tools:**
- Review logs for source IPs associated with recent scans (IPs from Australia, US, and Germany have been noted by Previdian).
- Use network security monitoring to flag unauthorized access attempts to `/nf/auth/` or SAML-related endpoints.
## References
- **Vendor Advisory:** hxxps[://]support[.]citrix[.]com/article/CTX696939
- **Security Intelligence:** hxxps[://]previdian[.]com/CVE-2026-19490
- **Government Warning:** hxxps[://]ccb[.]belgium[.]be/advisories/warning-critical-authentication-bypass-citrix-netscaler-adc-netscaler-gateway-patch
- **NVD Entry:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-19490