Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

🚨SEVERITY: CRITICAL — CVSS 9.8Security Advisory

TL;DR 📌

  • Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.
  • Highest CVSS: 9.8 (Critical).
  • Listed in CISA KEV (2026-09-09) — this is being exploited in the wild.
  • Fixed in 13.1-37.277, 13.1-63.21, 14.1-73.32 — upgrade to this release or later.
  • CVEs: CVE-2026-19490.

What it is

CVE-2026-19490 is an authentication bypass in Citrix NetScaler ADC and NetScaler Gateway. The flaw sits in how the appliance validates identity when it has been configured as an AAA virtual server, or as a Gateway serving SSL VPN, ICA Proxy, CVPN, or RDP Proxy. Citrix describes it as bypass via an alternate path or channel — the login route intended to enforce authentication can be circumvented.

The attack requires no credentials and no user interaction. The CVSS vector confirms network access, low attack complexity, no privileges required, and no user interaction, with full impact on confidentiality, integrity and availability. In practice, an unauthenticated remote party reaching the AAA vServer or Gateway interface may bypass the authentication step entirely, gaining the access that step was meant to gate.

Affected versions, as given by Citrix: ADC and Gateway from 14.1 through 73.32, and from 13.1 through 63.21. This is a management/access-plane issue tied specifically to appliances configured for AAA, SSL VPN, ICA Proxy, CVPN, or RDP Proxy — the exposure depends on which of these roles is enabled on the box.

This CVE is listed in the CISA Known Exploited Vulnerabilities catalogue, added 9 September 2026, so it is known to be exploited.

What to do

  • Identify every NetScaler ADC and Gateway instance configured with an AAA virtual server, or acting as Gateway for SSL VPN, ICA Proxy, CVPN, or RDP Proxy — these are the exposed roles.
  • Upgrade to the fixed builds: 13.1-37.277, 13.1-63.21, or 14.1-73.32, selecting the release line that matches your current branch.
  • Treat this as urgent given KEV listing — patch ahead of routine maintenance windows, particularly on internet-facing Gateway/AAA deployments.
  • After patching, review authentication and session logs on affected vServers for anomalies predating the fix, since the bypass leaves the normal login flow looking unremarkable.
  • If immediate patching isn’t possible, restrict network reachability to the AAA/Gateway interfaces as a temporary compensating control, and prioritise the upgrade as soon as a window opens.

For leadership 🧭

Executive summary. Any NetScaler ADC or Gateway box configured for AAA, SSL VPN, ICA Proxy, CVPN or RDP Proxy can be accessed by an unauthenticated attacker who bypasses the login entirely, with full read/write/availability impact. Citrix and CISA’s KEV listing indicate this is being actively exploited, so remediation should happen this week, not at the next scheduled window.

Why it matters:

  • The bypass affects the specific access roles most exposed to the internet: AAA virtual servers and Gateway modes (SSL VPN, ICA Proxy, CVPN, RDP Proxy) - the very features organisations use for remote access.
  • No credentials or user interaction are needed; the CVSS vector shows network-reachable, low-complexity attack with full confidentiality, integrity and availability impact.
  • Because the login flow itself is circumvented, normal authentication logs may show nothing unusual, making silent compromise possible before detection.
  • Confirmed inclusion in CISA’s KEV catalogue (added 9 September 2026) means this flaw is already being used against real deployments, not just theoretically exploitable.

Now / Next / Later:

  • Now: Identify every NetScaler ADC and Gateway instance running as an AAA virtual server or Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) and check its build against the affected version ranges.
  • Next: Upgrade affected appliances to 13.1-37.277, 13.1-63.21, or 14.1-73.32 as appropriate, prioritising internet-facing Gateway and AAA deployments ahead of routine change windows.
  • Later: Build a standing inventory of NetScaler role configurations (AAA/Gateway modes) so future advisories tied to these specific features can be triaged and patched immediately, and restrict network exposure to these interfaces by default.

Source