CVE-2026-19490 · Critical · CISA KEV

Citrix NetScaler Auth Bypass (CVE-2026-19490) in KEV: Critical Risk to AAA/VPN

Threat Engine Auto-Feed · data current as of 2026-09-10

CVE-2026-19490 is an authentication bypass vulnerability in Citrix NetScaler ADC and Gateway, listed in CISA KEV due to active exploitation. When configured as an AAA virtual server or Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy), it allows unauthenticated remote attackers to bypass authentication. This poses a critical risk to organizations relying on NetScaler for secure access.

  • CVSS:
  • EPSS percentile: 0.92891
  • Exploitation pressure: 81/100 (Critical)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 93th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability involves an 'alternate path or channel' that allows an attacker to bypass the intended authentication mechanisms. Essentially, there's a hidden or unintended way to access resources or services without providing valid credentials, circumventing the security controls designed to protect them.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using Citrix NetScaler ADC or Gateway for remote access (SSL VPN, ICA Proxy, CVPN, RDP Proxy)
  • Enterprises with NetScaler appliances configured as AAA virtual servers
  • Financial services, technology, and any sector relying on NetScaler for critical infrastructure access

Misconfigurations that escalate it

  • NetScaler appliances configured as AAA virtual servers without additional compensating controls
  • NetScaler Gateway instances used for SSL VPN, ICA Proxy, CVPN, or RDP Proxy without robust multi-factor authentication (MFA) or network segmentation

High-impact scenarios

  • Unauthenticated remote access to internal networks and sensitive resources via VPN bypass, leading to data theft or system compromise.
  • Attackers gaining initial access to corporate networks, enabling further lateral movement and privilege escalation.
  • Compromise of critical infrastructure components managed or accessed through NetScaler, potentially leading to operational disruption.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor NetScaler access logs for unusual authentication bypass attempts or successful logins from unexpected sources.
  • Implement network intrusion detection systems (NIDS) to identify anomalous traffic patterns to and from NetScaler appliances.
  • Regularly audit NetScaler configurations to ensure adherence to security best practices and identify any unauthorized changes.

Contain

  • Isolate affected NetScaler appliances from critical internal networks if immediate patching is not feasible.
  • Temporarily disable or restrict access to NetScaler Gateway functionalities (SSL VPN, ICA Proxy, CVPN, RDP Proxy) if an immediate patch cannot be applied.
  • Enforce strict network segmentation to limit potential lateral movement if a bypass occurs.

Patch

  • Apply vendor-provided security patches for Citrix NetScaler ADC and NetScaler Gateway immediately upon availability.
  • Follow Citrix's official security advisories for specific version updates and mitigation steps.

Frontier verdict — Critical

This is a critical authentication bypass vulnerability in Citrix NetScaler, actively exploited in the wild (CISA KEV) with a high EPSS percentile, demanding immediate patching for all affected deployments.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.