A critical authentication bypass flaw in Citrix NetScaler appliances is now being actively targeted in the wild. Tracked as CVE-2026-19490, the vulnerability allows an unauthenticated attacker to bypass login controls remotely when the appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy). Citrix patched the flaw on August 19, 2026 and urged administrators to upgrade immediately — but vulnerability intelligence firm Previdian reported this week that exploitation attempts began on September 3, just days after a credible proof-of-concept exploit was published online. Sensors operated by Previdian’s founder Ryan Dewhurst recorded requests matching the PoC from source IPs in Australia, the United States, and Germany.
Belgium’s National Cybersecurity Coordination Centre (NCC-BE) also issued its own warning on Friday, urging organizations to prioritize patching. Shadowserver tracks more than 22,000 NetScaler ADC appliances and nearly 1,700 Gateway instances exposed to the internet, and it’s not yet known how many remain unpatched and in a vulnerable configuration. Citrix has a long history of zero-day exploitation: CISA has tagged 23 Citrix vulnerabilities as actively exploited since 2021, six of which were subsequently weaponized by ransomware gangs.
How to check if you’re affected
Affected products are Citrix NetScaler ADC and NetScaler Gateway appliances configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy). Check your firmware versions against Citrix security bulletin CTX696939 and upgrade to the recommended builds immediately. If you cannot patch right away, monitor for unexpected authentication attempts on your management interfaces.