EXPOSURES › CVE-2026-19490
CVE-2026-19490
HIGH ⌖ ON CISA KEV · EXPLOITEDAn unauthenticated remote attacker can bypass Citrix NetScaler authentication via an alternate path, enabling full system compromise.
Citrix NetScaler ADC and Gateway allow unauthenticated attackers to bypass authentication through an alternate channel, granting full system access. This is critical for DIB organizations relying on Citrix for secure remote access, as it directly undermines the zero-trust model and violates NIST 800-171 access control requirements. Organizations must immediately patch NetScaler appliances and review their remote access architecture.
Shame score — A fundamental authentication bypass allowing unauthenticated remote code execution represents a severe, avoidable failure in core security design that directly enables mass compromise.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.
| PRODUCT | STATUS |
|---|---|
| Citrix for Government Citrix |
Authorized |