THREAT OPS › CVEs › CVE-2026-19490
CVE-2026-19490 — Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.
Vulnerability details
- Affected productsNetScaler
- KEV remediation due2026-09-12
Related reporting
- Citrix Products Multiple Vulnerabilitieshkcert
- CISA Adds Four Known Exploited Vulnerabilities to Catalogcisa_advisories
- [CISA KEV] CVE-2026-19490 — Citrix NetScaler: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerabilitycisa_kev
- AL26-019 - Vulnerabilities impacting Citrix NetScaler ADC and NetScaler Gateway - CVE-2026-19490 and CVE-2026-19489cccs_ca
- Critical Citrix NetScaler auth bypass now leveraged in attacksbleepingcomputer
- 24th August – Threat Intelligence Reportcheckpoint_research
- CVE-2026-19490: NetScaler Auth Bypass Patchedsocradar_blog
- Citrix security advisory (AV26-833)cccs_ca
- CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gatewayrapid7