# CVE-2026-19490: Citrix NetScaler authentication bypass via alternate path

Source: https://junglewise.ai/threats/cve-2026-19490-citrix-netscaler-authentication-bypass-via-alternate-path  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-19490 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-08-19

Citrix NetScaler is a critical networking appliance used by enterprises to manage user authentication and provide secure remote access through VPN and proxy services. This vulnerability allows attackers to completely bypass authentication and gain unauthorized access to protected applications and networks without valid credentials, potentially exposing sensitive business systems and data to compromise.

Technologies: [Citrix NetScaler](https://junglewise.ai/threats/technologies/netscaler), [Citrix NetScaler ADC](https://junglewise.ai/threats/technologies/netscaler-adc), [Citrix NetScaler Gateway](https://junglewise.ai/threats/technologies/gateway). Vendors: [Citrix](https://junglewise.ai/threats/vendors/citrix).

## Quick answers

**Is CVE-2026-19490 exploited in the wild?** Yes. CVE-2026-19490 is known to be exploited in the wild, first recorded on 9 September 2026. Treat it as urgent.

**How severe is CVE-2026-19490?** Critical severity, with a CVSS score of 9.8, published 19 August 2026.

**Which products and versions are affected?** Citrix NetScaler ADC; Citrix NetScaler Gateway.

**Is there a fix for CVE-2026-19490?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-19490 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-19490?** Check whether you run Citrix NetScaler, Citrix NetScaler ADC or Citrix NetScaler Gateway. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass flaw in Citrix NetScaler ADC and NetScaler Gateway that affects systems configured as AAA virtual servers or Gateways (SSL VPN, ICA Proxy, CVPN, RDP Proxy). The vulnerability exists due to improper handling of an alternate authentication path or channel, allowing unauthenticated remote attackers to bypass the authentication mechanism without valid credentials. The attack is network-accessible and requires no prior authentication or user interaction. Successful exploitation grants unauthorized access to gateway functionality and protected resources. The vulnerability has been observed exploited in the wild, indicating active threat actor activity. Patched versions and mitigation guidance from Citrix should be applied immediately.

## Affected products

- Citrix NetScaler ADC
- Citrix NetScaler Gateway

## Timeline

- 2026-09-09: disclosed
- exploited: Observed exploited in wild

## Related threats

- [Citrix NetScaler ADC memory overflow in LDAP authentication](https://junglewise.ai/threats/cve-2026-111342-memory-overflow-in-ldap-authentication-can-lead-to-unpredictable)
- [Citrix NetScaler memory overflow in client-certificate authentication](https://junglewise.ai/threats/cve-2026-111341-memory-overflow-in-client-certificate-authentication-can-lead-to)
- [Citrix NetScaler memory overflow in KBA authentication](https://junglewise.ai/threats/cve-2026-111340-memory-overflow-in-kba-knowledge-based-authentication-can-lead)
- [Citrix NetScaler ADC memory overflow in Email OTP authentication](https://junglewise.ai/threats/cve-2026-107415-memory-overflow-in-email-otp-authentication-can-lead-to)
- [Citrix NetScaler ADC memory overflow in WebAuth authentication](https://junglewise.ai/threats/cve-2026-107414-memory-overflow-in-webauth-authentication-can-lead-to)