CVE-2026-19490: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.
Other sources
Vulnerability in NetScaler ADC and NetScaler Gateway.
This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Citrix NetScaler ADCto a version that resolves this vulnerability.Fixed in 14.1 through 73.32Patch NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490 - Upgrade
Upgrade
Citrix NetScaler Gatewayto a version that resolves this vulnerability.Fixed in 14.1 through 73.32Patch NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490 - Configuration
Review configurations where the appliance is configured as an AAA virtual server or a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), and remove/disable the affected externally reachable paths/channels to prevent unauthenticated authentication bypass.
Citrix NetScaler appliance (AAA virtual server / Gateway - SSL VPN, ICA Proxy, CVPN, RDP Proxy) Authentication-bypass alternate path or channel (reduce exposure) = Unauthenticated remote access via alternate path/channel - Compensating control
Evaluate each Citrix NetScaler ADC and NetScaler Gateway asset’s internet exposure, and ensure mitigations/patching follow CISA BOD 26-04 (Prioritizing Security Updates Based on Risk) guidance; if mitigations are unavailable for cloud services, discontinue use of the product per the provided guidance.
Event History
Frequently Asked Questions
Which deployments are in scope based on the affected-version information?
NetScaler ADC deployments from 14.1 through 73.32 and from 13.1 through 63.21 are affected. The same version ranges are listed for NetScaler Gateway.
Does the available information indicate whether default configurations are vulnerable or whether exploitation requires authentication?
No. The provided information does not state configuration prerequisites, network exposure requirements, or whether an attacker must authenticate.
What mitigations are available if an update cannot be applied immediately?
The provided information does not include temporary mitigations or compensating controls. It only identifies the affected NetScaler ADC and NetScaler Gateway version ranges.