Critical authentication bypass in Citrix NetScaler ADC and Gateway
Unauthenticated auth bypass in Citrix NetScaler ADC and Gateway (CVSS 9.3) allows remote exploitation with no user interaction. Patches released August 19, 2026 for 13.1 and 14.1 branches.
- Vendor
- Citrix
- Product
- NetScaler ADC, NetScaler Gateway
- CVSS
- 9.3
- EPSS (exploit probability)
- 23.2%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-19490 being exploited?
Yes. CISA added CVE-2026-19490 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 23.2% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-21. Full cross-catalog view: /kev-comparison
CVE-2026-19490 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
An unauthenticated authentication bypass in Citrix NetScaler ADC and NetScaler Gateway, carrying a CVSS v4.0 base score of 9.3. An attacker can reach the flaw remotely with no user interaction and no elevated privileges required — the full trifecta for a network-edge product.
Affected Versions
| Product | Vulnerable if running | Fixed in |
|---|---|---|
| NetScaler ADC/Gateway 14.1 | Prior to 14.1-73.32 | 14.1-73.32 |
| NetScaler ADC/Gateway 13.1 | Prior to 13.1-63.21 | 13.1-63.21 |
| NetScaler ADC FIPS 14.1 | Prior to 14.1-73.32 FIPS | 14.1-73.32 FIPS |
| NetScaler ADC 13.1-FIPS/NDcPP | Prior to 13.1-37.277 | 13.1-37.277 |
Mitigation
No workaround listed. Update to the fixed release for your branch. Citrix’s advisory CTX696939 is the authoritative patch guidance. Prioritize internet-facing Gateway appliances first.
As of August 19, 2026, no exploitation in the wild has been confirmed per Rapid7’s early technical assessment. Given the class of vulnerability and the perimeter position of these products, that status should be treated as time-limited.
Other Citrix NetScaler ADC and NetScaler Gateway CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-107406 Memory overflow in Citrix NetScaler ADC and Gateway SAML handlingwrite-up | [ CRITICAL ] | 9.5 | 0.5% | — |
| CVE-2026-88779 Citrix NetScaler Memory Buffer Flaw Enables Denial-of-Service Attackswrite-up | [ HIGH ] | 7.5 | 0.6% | |
| CVE-2026-88772 Citrix NetScaler ADC/Gateway RCE via Memory Buffer Mishandlingwrite-up | [ HIGH ] | — | 1.3% | |
| CVE-2026-88771 Citrix NetScaler ADC/Gateway Unauthenticated RCE via Input Validation Flawwrite-up | [ HIGH ] | — | 1.1% | |
| CVE-2026-8452 Citrix NetScaler ADC and Gateway Memory Buffer Overflowwrite-up | [ CRITICAL ] | 9.8 | 1.0% | |
| CVE-2025-5777 Citrix Bleed 2 — NetScaler ADC/Gateway memory-disclosure leaking session tokensransomware usewrite-up | [ HIGH ] | 7.5 | 100.0% | |
| CVE-2025-6543 Citrix NetScaler ADC and Gateway Buffer Overflow Vulnerability | [ CRITICAL ] | 9.8 | 10.6% | |
| CVE-2023-6549 Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability | [ HIGH ] | 8.2 | 57.6% |
