Citrix NetScaler Auth Bypass Now Exploited in Wild

Attackers have begun targeting CVE-2026-19490, the critical authentication bypass in Citrix NetScaler ADC and NetScaler Gateway that Citrix patched on August 19. Vulnerability intelligence firm Previdian confirmed active exploitation Thursday, per BleepingComputer.

The flaw carries a CVSS v4.0 base score of 9.3. Unauthenticated, remote, no user interaction required. We noted at the time that Citrix perimeter products have a documented pattern of rapid weaponization after advisory disclosure. Sixteen days, as it turned out.

What’s at risk

NetScaler ADC and NetScaler Gateway sit at or near the network perimeter, handling VPN access, application delivery, and load balancing for enterprise traffic. An authentication bypass at that layer means an unauthenticated attacker can reach functionality that should require credentials.

Affected versions and their fixed counterparts:

What to do

If you haven’t patched: the authoritative guidance is Citrix advisory CTX696939. Update to the fixed release for your branch. Internet-facing Gateway appliances first, everything else after.

If you patched in August: check your logs for anomalous authentication activity between August 19 and your patch date. An exploited auth bypass does not always surface immediately.

There is no workaround for CVE-2026-19490. The fix is the patch.

The Citrix pattern

Citrix NetScaler products have a short window between advisory and active exploitation. Citrix Bleed went from disclosure to mass exploitation in days; CVE-2026-8452 landed in the CISA KEV catalog within weeks of its patch. CVE-2026-19490 has now followed.

If your organization runs NetScaler appliances and your standard patch cycle runs longer than two to three weeks, these products probably belong in a faster maintenance tier.