CVE-2026-19490 is an authentication bypass vulnerability affecting certain customer-managed NetScaler ADC and NetScaler Gateway appliances. An unauthenticated remote attacker may be able to bypass authentication when an affected appliance is configured as a Gateway or AAA virtual server and meets the applicable build-specific conditions. The vulnerability is rated Critical (CVSS 3.x score of 9.8).
CVE-2026-19490 | Citrix NetScaler ADC and NetScaler Gateway Authentication Bypass Vulnerability
About this summary. This is a short excerpt from the description that Horizon3.ai published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://horizon3.ai/attack-research/vulnerabilities/cve-2026-19490/
Source attribution: headline and facts are from Horizon3.ai (horizon3.ai). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Citrix warns admins to patch new NetScaler RCE flaw immediately
Citrix has warned IT administrators to patch systems immediately against a new critical vulnerability affecting NetScaler ADC networking appliances and NetScaler Gateway…
US, Australia warn of latest Citrix vulnerability after NetScaler advisory
Citrix confirmed late on Friday that it was “tracking a newly observed issue” related to some customer-managed NetScaler deployments but claimed the problem was not…
Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs
Threat actors have been observed exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway to drop web…
Dual NetScaler Zero-Days Trigger Chaos for Citrix Customers
The critical vulnerabilities, which impact default configurations of NetScaler products, essentially give attackers a skeleton key to customers' networks.
U.S. CISA adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog. The U.S.
Bellini Capital CISO on AI security governance and the limits of patching faster
In this Help Net Security interview, Brian Blakley, CISO at Bellini Capital, explains why AI makes finding vulnerabilities faster while fixing them still takes time. He…