https://www.phllaps.net/tags/citrix/ Recent content in Citrix on PhllapsNET Hugo en-gb Wed, 09 Sep 2026 00:00:00 +0000 https://www.phllaps.net/posts/citrix-netscaler-authentication-bypass-using-an-alternate-path-or-channel-vulnerability/ Wed, 09 Sep 2026 00:00:00 +0000 https://www.phllaps.net/posts/citrix-netscaler-authentication-bypass-using-an-alternate-path-or-channel-vulnerability/ <div style="background:#b91c1c;color:white;padding:16px 18px;border-radius:14px;font-weight:800;font-size:18px;display:flex;align-items:center;gap:12px;box-shadow:0 10px 24px rgba(0,0,0,0.18);"><span style="font-size:24px;">🚨</span><span>SEVERITY: CRITICAL — CVSS 9.8</span><span style="opacity:0.95;font-weight:700;margin-left:auto;">Security Advisory</span></div> <h2 id="tldr-">TL;DR 📌</h2> <ul> <li>Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.</li> <li>Highest CVSS: <strong>9.8 (Critical)</strong>.</li> <li><strong>Listed in CISA KEV</strong> (2026-09-09) — this is being exploited in the wild.</li> <li><strong>Fixed in <code>13.1-37.277</code>, <code>13.1-63.21</code>, <code>14.1-73.32</code></strong> — upgrade to this release or later.</li> <li>CVEs: CVE-2026-19490.</li> </ul> <h2 id="what-it-is">What it is</h2> <p>CVE-2026-19490 is an authentication bypass in Citrix NetScaler ADC and NetScaler Gateway. The flaw sits in how the appliance validates identity when it has been configured as an AAA virtual server, or as a Gateway serving SSL VPN, ICA Proxy, CVPN, or RDP Proxy. Citrix describes it as bypass via an alternate path or channel — the login route intended to enforce authentication can be circumvented.</p>