Citrix NetScaler ADC and Gateway Authentication Bypass and RCE Vulnerability (CVE-2026-19490)

Affected Vendors

Citrix

Affected Components

NetScaler ADC, NetScaler Gateway

Published Date

2026-08-19

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

NetScaler ADC and Gateway versions 14.1 (prior to 73.32) and 13.1 (prior to 63.21)

Impact

Potential for administrative privilege gain and Remote Code Execution (RCE) via authentication bypass

Mitigation

Apply official Citrix patches and restrict Management Interface (NSIP) access

Affected Products & Version Scope

NetScaler ADC and NetScaler Gateway versions 14.1 through 73.32 and 13.1 through 63.21 are affected.

Remediation & Live Workaround Commands

PATCH & WORKAROUND

Immediate Patching: Update to NetScaler ADC/Gateway 14.1-73.32, 13.1-63.21, or higher as per Citrix Advisory CTX696939. 2. Isolate Management Interface: Ensure the NSIP (Management IP) is not exposed to the public internet. Restrict access to internal management VLANs or via VPN. 3. ACL Configuration: Use the following command to restrict access:

bash

add ns acl RESTRICT_MGMT ALLOW -srcIP [Admin_IP] -destPort 443

followed by

bash

apply ns acls

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Immediately apply the latest security updates and restrict access to the management interface.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

This vulnerability is a CWE-288 (Authentication Bypass Using an Alternate Path) flaw within the NetScaler authentication framework. An attacker can bypass standard authentication mechanisms via specially crafted HTTP requests to gain unauthorized administrative access. Its inclusion in the CISA KEV catalog and a high EPSS score of 0.94 confirm active, widespread exploitation in the wild. This flaw is frequently used by threat actors as a primary entry point for ransomware and data exfiltration campaigns.

Official Vendor Advisories & References

NVD Original English Description

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939

Source: 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19490

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed: