CVE Details

CVE-2026-19490 Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
Published: 2026-09-09 CVSS: 9.3 CRITICAL Product: Citrix NetScaler Due Date: 2026-09-12

Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.

GitHub PoC

Warning: GitHub PoC repositories are unverified. Some may be fake or contain malware. Use caution and review code before running anything.
  • 0xMarcio/pocindex • ⭐ 1392 • 2024-05-24 • Conf: 80.0%
  • Search 82,000+ public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub.
  • TarPeg007/CVE-2026-19490 • ⭐ 12 • 2026-09-02 • Conf: 95.0%
  • NetScaler ADC/Gateway SAML unsigned-assertion bypass via HTTP-Redirect binding (CTX696939) - root cause analysis + PoC

FIRST EPSS

EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.

Timeline

CVE Stalker KEV MITRE GitHub FIRST (EPSS)

MITRE

CVSS

  • Score: 9.3
  • Severity: CRITICAL
  • Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

SSVC

  • Exploitation: none
  • Automatable: yes
  • Technical Impact: total

References

Show Raw Data
Key Remaining Key Value
dataType CVE_RECORD
dataVersion 5.2
cveMetadata > cveId CVE-2026-19490
cveMetadata > assignerOrgId 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5
cveMetadata > state PUBLISHED
cveMetadata > assignerShortName NetScaler
cveMetadata > dateReserved 2026-08-10T17:39:56.668Z
cveMetadata > datePublished 2026-08-19T12:54:39.730Z
cveMetadata > dateUpdated 2026-08-20T13:22:42.320Z
containers > cna > providerMetadata > orgId 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5
containers > cna > providerMetadata > shortName NetScaler
containers > cna > providerMetadata > dateUpdated 2026-08-19T12:54:39.730Z
containers > cna > title NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
containers > cna > affected > 0 > vendor NetScaler
containers > cna > affected > 0 > product ADC
containers > cna > affected > 0 > versions > 0 > status affected
containers > cna > affected > 0 > versions > 0 > version 14.1
containers > cna > affected > 0 > versions > 0 > lessThanOrEqual 73.32
containers > cna > affected > 0 > versions > 0 > versionType patch
containers > cna > affected > 0 > versions > 1 > status affected
containers > cna > affected > 0 > versions > 1 > version 13.1
containers > cna > affected > 0 > versions > 1 > lessThanOrEqual 63.21
containers > cna > affected > 0 > versions > 1 > versionType patch
containers > cna > affected > 0 > defaultStatus unaffected
containers > cna > affected > 1 > vendor NetScaler
containers > cna > affected > 1 > product Gateway
containers > cna > affected > 1 > versions > 0 > status affected
containers > cna > affected > 1 > versions > 0 > version 14.1
containers > cna > affected > 1 > versions > 0 > lessThanOrEqual 73.32
containers > cna > affected > 1 > versions > 0 > versionType patch
containers > cna > affected > 1 > versions > 1 > status affected
containers > cna > affected > 1 > versions > 1 > version 13.1
containers > cna > affected > 1 > versions > 1 > lessThanOrEqual 63.21
containers > cna > affected > 1 > versions > 1 > versionType patch
containers > cna > affected > 1 > defaultStatus unaffected
containers > cna > descriptions > 0 > lang en
containers > cna > descriptions > 0 > value Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.
containers > cna > descriptions > 0 > supportingMedia > 0 > type text/html
containers > cna > descriptions > 0 > supportingMedia > 0 > base64 False
containers > cna > descriptions > 0 > supportingMedia > 0 > value Vulnerability in NetScaler ADC and NetScaler Gateway.<p>This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.</p>
containers > cna > references > 0 > url https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939
containers > cna > metrics > 0 > format CVSS
containers > cna > metrics > 0 > scenarios > 0 > lang en
containers > cna > metrics > 0 > scenarios > 0 > value GENERAL
containers > cna > metrics > 0 > cvssV4_0 > attackVector NETWORK
containers > cna > metrics > 0 > cvssV4_0 > attackComplexity LOW
containers > cna > metrics > 0 > cvssV4_0 > attackRequirements NONE
containers > cna > metrics > 0 > cvssV4_0 > privilegesRequired NONE
containers > cna > metrics > 0 > cvssV4_0 > userInteraction NONE
containers > cna > metrics > 0 > cvssV4_0 > vulnConfidentialityImpact HIGH
containers > cna > metrics > 0 > cvssV4_0 > subConfidentialityImpact LOW
containers > cna > metrics > 0 > cvssV4_0 > vulnIntegrityImpact HIGH
containers > cna > metrics > 0 > cvssV4_0 > subIntegrityImpact LOW
containers > cna > metrics > 0 > cvssV4_0 > vulnAvailabilityImpact HIGH
containers > cna > metrics > 0 > cvssV4_0 > subAvailabilityImpact LOW
containers > cna > metrics > 0 > cvssV4_0 > exploitMaturity NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > Safety NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > Automatable NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > Recovery NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > valueDensity NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > vulnerabilityResponseEffort NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > providerUrgency NOT_DEFINED
containers > cna > metrics > 0 > cvssV4_0 > version 4.0
containers > cna > metrics > 0 > cvssV4_0 > baseSeverity CRITICAL
containers > cna > metrics > 0 > cvssV4_0 > baseScore 9.3
containers > cna > metrics > 0 > cvssV4_0 > vectorString CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
containers > cna > source > discovery UNKNOWN
containers > cna > x_generator > engine Vulnogram 1.0.4
containers > adp > 0 > problemTypes > 0 > descriptions > 0 > type CWE
containers > adp > 0 > problemTypes > 0 > descriptions > 0 > cweId CWE-288
containers > adp > 0 > problemTypes > 0 > descriptions > 0 > lang en
containers > adp > 0 > problemTypes > 0 > descriptions > 0 > description CWE-288 Authentication Bypass Using an Alternate Path or Channel
containers > adp > 0 > metrics > 0 > other > type ssvc
containers > adp > 0 > metrics > 0 > other > content > timestamp 2026-08-20T03:56:10.740519Z
containers > adp > 0 > metrics > 0 > other > content > id CVE-2026-19490
containers > adp > 0 > metrics > 0 > other > content > options > 0 > Exploitation none
containers > adp > 0 > metrics > 0 > other > content > options > 1 > Automatable yes
containers > adp > 0 > metrics > 0 > other > content > options > 2 > Technical Impact total
containers > adp > 0 > metrics > 0 > other > content > role CISA Coordinator
containers > adp > 0 > metrics > 0 > other > content > version 2.0.3
containers > adp > 0 > title CISA ADP Vulnrichment
containers > adp > 0 > providerMetadata > orgId 134c704f-9b21-4f2e-91b3-4a467353bcc0
containers > adp > 0 > providerMetadata > shortName CISA-ADP
containers > adp > 0 > providerMetadata > dateUpdated 2026-08-20T13:22:42.320Z