CVE-2026-19490: Citrix NetScaler ADC/Gateway Authentication Bypass
CVE-2026-19490 is an authentication-bypass flaw in Citrix NetScaler ADC and NetScaler Gateway that lets an unauthenticated remote attacker bypass login when the appliance is set up as an AAA virtual server or as an SSL-VPN/ICA-Proxy/CVPN/RDP-Proxy Gateway, and CISA has confirmed active exploitation by adding it to the KEV catalog with a three-day remediation window.
Vulnerability summary
| Vulnerability ID | CVE-2026-19490 |
|---|---|
| CVSS score | 9.8 |
| EPSS score | 0.3265 |
| CISA KEV | Yes — in the Known Exploited Vulnerabilities catalog |
| Source | NVD |
| Published | 2026-08-19T13:17:45.000 |
Affected components
| Component | CPE | Version range |
|---|---|---|
| Citrix NetScaler ADC | cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* | 13.1 before 13.1-63.21; 14.1 before 14.1-73.32 (FIPS builds: 13.1 before 13.1-37.277, and 14.1-66.68 through 14.1-73.32; NDcPP builds: 13.1 before 13.1-37.277) |
| Citrix NetScaler Gateway | cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* | 13.1 before 13.1-63.21; 14.1 before 14.1-73.32 |
What this means
CVE-2026-19490 is a CWE-288 (Authentication Bypass Using an Alternate Path or Channel) vulnerability in Citrix NetScaler ADC and NetScaler Gateway. NVD's record states the issue "affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21" (NVD).
NVD published its own Primary CVSS v3.1 score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, high impact to confidentiality, integrity and availability. A separate CVSS v4.0 score of 9.3 is also on record, but it is attributed to CISA-ADP (an NVD-authorized data publisher), not to NVD's own analysis, so that v4.0 figure is not NVD-confirmed and is not used as this page's score (NVD).
CISA added CVE-2026-19490 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-09, with a required-action due date of 2026-09-12 — just three days later — and flagged "forensicTriage: Yes" under BOD 26-04, meaning affected organizations must follow CISA's forensic-triage requirements in addition to patching. CISA's own short description explains the access path precisely: "When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication." The catalog entry records known ransomware campaign use as "Unknown" — so this should be read as a confirmed-exploited authentication bypass, not as a vulnerability with a documented ransomware tie; we are not overstating that connection (CISA KEV, catalog version 2026.10.28, 1,762 entries, confirmed live this run).
As of 2026-10-28, FIRST scores the probability of exploitation at 0.3265 (32.65%), 98.3rd percentile — high relative to most CVEs, but here the KEV listing itself (not the EPSS figure alone) is the basis for calling this actively exploited; EPSS corroborates rather than drives that conclusion (FIRST EPSS).
Any NetScaler ADC or Gateway appliance on the affected build ranges, configured as an AAA virtual server or as a Gateway, should be upgraded past the fixed builds above immediately; CISA's required action also directs stakeholders to evaluate each asset's internet exposure and, per BOD 26-04 guidance, to discontinue internet-facing use of the product if mitigations are unavailable.
Evidence
- Authentication-bypass-using-an-alternate-path-or-channel vulnerability (CWE-288) in Citrix NetScaler ADC and NetScaler Gateway, affecting ADC/Gateway 14.1 through 73.32 and 13.1 through 63.21. — NVD
- NVD Primary CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; a separate CVSS v4.0 9.3 score is attributed to CISA-ADP, not NVD's own analysis. — NVD
- Added to the CISA KEV catalog on 2026-09-09, required-action due date 2026-09-12, forensic triage required under BOD 26-04; exploitable when the appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy); known ransomware campaign use recorded as "Unknown". Catalog version 2026.10.28, 1,762 entries, confirmed live this run. — CISA KEV
- EPSS score is 0.3265 (32.65%), 98.3rd percentile, as of 2026-10-28. — FIRST EPSS