Vulnerability in NetScaler ADC and NetScaler Gateway.

CVE-2026-19490 is an authentication bypass via alternate path (CWE-288) in Citrix NetScaler ADC and NetScaler Gateway. It affects all deployments configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server — which is the *canonical* deployment mode for these appliances. Affected version ranges are 14.1 before 14.1-73.32 and 13.1 before 13.1-63.21, plus corresponding FIPS (14.1-73.32 FIPS) and NDcPP (13.1-37.277) builds. The CVSS 4.0 vendor score is 9.3 Critical with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L. No authentication is required, no user interaction is needed, and complexity is low.

The vendor severity of 9.3 Critical is, if anything, *understated* for the operational reality. NetScaler Gateway exists to be the internet-facing authentication gate for remote users — every single Gateway deployment is reachable from the internet by design. An authentication bypass on this component is functionally equivalent to removing the front door of the corporate network. Citrix lists no workarounds, meaning patching is the only option. With ~40,000 NetScaler instances visible on Censys as of March 2026, the exposed population is large and the attacker economics are extremely favorable. This is the same class of perimeter auth-bypass that drove mass exploitation in CitrixBleed (CVE-2023-4966) and CVE-2026-3055.

Why this verdict

• No authentication required: The CVSS vector explicitly confirms PR:N. This is a zero-credential attack against a login page — the most favorable attacker economics possible.
• Role multiplier: NetScaler Gateway is a *canonical* network edge appliance. By definition, ≥95% of Gateway deployments are internet-facing — that is the product's entire purpose. An auth bypass on the perimeter VPN gateway gives an attacker a beachhead equivalent to a valid employee VPN session. The blast radius extends from the appliance (credential extraction, TLS key theft) through the entire internal network (VPN tunnel routing). This is fleet-scale impact. The verdict floor is CRITICAL per the network edge appliance rule.
• No workaround exists: Citrix explicitly states no mitigations are available. This eliminates the usual friction point of 'deploy WAF rule while you plan patching.' The only path is firmware upgrade.
• Historical exploitation pattern: Every major Citrix Gateway auth-adjacent vulnerability in the past 3 years (CVE-2023-4966 CitrixBleed, CVE-2023-3519, CVE-2026-3055, CVE-2026-8452) has been weaponized rapidly, often within days. Ransomware operators (LockBit, ALPHV successors) have specifically targeted NetScaler as an initial access vector.
• Massive exposed population: ~40,000–56,000 instances visible on internet scanning platforms. This is not a niche product with a handful of deployments — it is a primary enterprise remote access platform.

Why not higher?

A 9.6 is already near the ceiling. The only gap to 10.0 is the absence of *confirmed* in-the-wild exploitation and a public PoC as of disclosure day. Once either appears, the operational urgency increases but the technical severity assessment would not meaningfully change.

Why not lower?

Every friction audit point *favors* the attacker: the target is internet-facing by design (no network position required), no credentials needed, no user interaction, low complexity, no workaround available, and the product class has a proven track record of rapid mass exploitation. There is no legitimate basis to assess below CRITICAL. The blast radius — perimeter gateway to internal network — is the most consequential initial-access scenario in enterprise security.

1. Restrict management and Gateway VIPs to known IP ranges via ACLs — If your Gateway serves a defined user population (e.g., corporate IP ranges, specific countries), apply network ACLs on the NetScaler or upstream firewall to drop traffic from unexpected sources. This reduces the exposed attack surface while you patch. Deploy within the 3-day noisgate mitigation SLA for CRITICAL findings.
2. Enable and monitor NetScaler audit logging for sessionless authentications — Configure nsauditlog and forward to your SIEM. Alert on any SESSION_CREATED events that lack a corresponding AUTH_SUCCESS from your RADIUS/LDAP/SAML IDP. This is the primary detection signal for auth-bypass exploitation. Deploy immediately.
3. Rotate all credentials stored on the appliance post-patch — After patching, rotate: nsroot password, LDAP bind credentials in ns.conf, SAML signing certificates, TLS private keys on all Gateway vservers, and any stored RADIUS shared secrets. Assume pre-patch compromise is possible. Complete within 7 days of patching.
4. Deploy IDS/IPS signatures for anomalous NetScaler auth flows — If your upstream IPS (Palo Alto, Fortinet, Snort) releases signatures for CVE-2026-19490, deploy them in blocking mode. Even generic 'NetScaler auth anomaly' rules provide partial coverage. Deploy within the 3-day mitigation window.

Run this script via SSH on each NetScaler appliance (requires nsroot or equivalent shell access). Example: ssh nsroot@<netscaler-ip> 'bash -s' < check_cve_2026_19490.sh. Requires shell access to the NetScaler BSD subsystem.

#!/bin/bash
# CVE-2026-19490 Version Check for NetScaler ADC / Gateway
# Run on the NetScaler appliance via SSH as nsroot
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

VERSION_FILE="/var/nsinstall/.version"
if [ ! -f "$VERSION_FILE" ]; then
  # Try alternate location
  VERSION_FILE="/var/nslog/install.log"
fi

# Get installed version
INSTALLED=$(nsapimgr_wr.sh -d version 2>/dev/null | grep -oP '\d+\.\d+-\d+\.\d+' | head -1)
if [ -z "$INSTALLED" ]; then
  INSTALLED=$(cat /var/nsinstall/.version 2>/dev/null | grep -oP '\d+\.\d+-\d+\.\d+' | head -1)
fi

if [ -z "$INSTALLED" ]; then
  echo "UNKNOWN - Could not determine NetScaler version"
  exit 2
fi

echo "Detected NetScaler version: $INSTALLED"

# Parse major.minor-build.rev
MAJOR=$(echo "$INSTALLED" | cut -d'.' -f1)
MINOR=$(echo "$INSTALLED" | cut -d'.' -f2 | cut -d'-' -f1)
BUILD=$(echo "$INSTALLED" | cut -d'-' -f2 | cut -d'.' -f1)
REV=$(echo "$INSTALLED" | cut -d'-' -f2 | cut -d'.' -f2)

# Check if Gateway or AAA vserver is configured (prerequisite)
GW_CONFIG=$(nscli -U :nsroot:nsroot show vpn vserver 2>/dev/null | grep -c 'Name:')
AAA_CONFIG=$(nscli -U :nsroot:nsroot show authentication vserver 2>/dev/null | grep -c 'Name:')

if [ "$GW_CONFIG" -eq 0 ] && [ "$AAA_CONFIG" -eq 0 ]; then
  echo "INFO: No Gateway or AAA vserver configured. Appliance may not be exploitable, but patching is still recommended."
fi

# Version comparison
# Fixed: 14.1-73.32+ or 13.1-63.21+
VULN=0
if [ "$MAJOR" -eq 14 ] && [ "$MINOR" -eq 1 ]; then
  if [ "$BUILD" -lt 73 ]; then
    VULN=1
  elif [ "$BUILD" -eq 73 ] && [ "$REV" -lt 32 ]; then
    VULN=1
  fi
elif [ "$MAJOR" -eq 13 ] && [ "$MINOR" -eq 1 ]; then
  if [ "$BUILD" -lt 63 ]; then
    VULN=1
  elif [ "$BUILD" -eq 63 ] && [ "$REV" -lt 21 ]; then
    VULN=1
  fi
elif [ "$MAJOR" -lt 13 ]; then
  echo "UNKNOWN - Version $INSTALLED is EOL and may or may not be affected"
  exit 2
else
  echo "UNKNOWN - Unexpected version $INSTALLED"
  exit 2
fi

if [ "$VULN" -eq 1 ]; then
  echo "VULNERABLE - NetScaler $INSTALLED is affected by CVE-2026-19490"
  exit 1
else
  echo "PATCHED - NetScaler $INSTALLED is not affected by CVE-2026-19490"
  exit 0
fi

Sources

1. Citrix Security Bulletin CTX696939
2. NVD - CVE-2026-19490
3. Censys Advisory — NetScaler Exposure Data
4. watchTowr Labs — Citrix NetScaler Pre-Auth RCE Analysis
5. Dark Reading — CitrixBleed-ing Again? NetScaler Under Attack
6. CyberScoop — Citrix NetScaler Flaw Echoes CitrixBleed
7. CERT-EU — Multiple Vulnerabilities in Citrix NetScaler