Unauthenticated authentication bypass in Citrix NetScaler ADC and Gateway (CVE-2026-19490)
VulnCheck added this to its KEV catalog on 2026-09-03 and BleepingComputer reported in-the-wild attacks on 2026-09-04, so teams still running an affected 14.1 or 13.1 build on an internet-facing Gateway or ADC risk unauthenticated compromise of the appliance.
An authentication bypass in NetScaler ADC and NetScaler Gateway lets an unauthenticated remote attacker reach protected functionality over the network with no user interaction (CVSS 4.0 9.3, AV:N/PR:N/UI:N). Citrix tracks the fix in advisory CTX696939; the Canadian Centre for Cyber Security issued alert AL26-019 covering it alongside CVE-2026-19489.
Affected: NetScaler ADC 14.1 builds up to and including 14.1-73.32; NetScaler ADC 13.1 builds up to and including 13.1-63.21; NetScaler Gateway 14.1 builds up to and including 14.1-73.32; NetScaler Gateway 13.1 builds up to and including 13.1-63.21
How to Test
Record the running build of every NetScaler ADC and Gateway instance and compare it against the affected ranges (14.1 through 73.32, 13.1 through 63.21); any appliance in range that is reachable from the internet should be treated as exposed. Review Gateway and authentication logs and active session tables for sessions established without a corresponding successful login, and follow the detection guidance in alert AL26-019.
How to Patch
Upgrade 14.1 appliances to a build later than 14.1-73.32 and 13.1 appliances to a build later than 13.1-63.21 as published in Citrix advisory CTX696939, upgrading HA pairs and cluster nodes together. Until upgraded, restrict internet access to the Gateway and management interfaces where operationally possible, and terminate existing sessions after patching so any session created via the bypass is invalidated.