CVE-2026-19490 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-08-19

Added to CISA KEV: 2026-09-09 21 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: This vulnerability is in CISA KEV with confirmed active exploitation and public PoC. Immediately hunt for indicators of compromise — review authentication logs, inspect for forged/anomalous sessions on /cgi/samlauth, check for unauthorized admin actions, web shells, and unexpected configuration changes. Assume potential compromise on any unpatched internet-facing instance.
Immediately upgrade NetScaler ADC and Gateway to fixed builds (beyond 14.1-73.32 and 13.1-63.21) per Citrix bulletin CTX696939. After patching, terminate/kill all active sessions and rotate secrets, as patching alone does not evict an already-present attacker.
Restrict management-interface exposure, review SAML/AAA vServer configurations, monitor for anomalous SAML redirect requests and session forgery patterns, and deploy IDS/WAF signatures targeting /cgi/samlauth exploitation attempts.
Patch priority: EMERGENCY / P0 — apply out-of-band within 24-48 hours given active exploitation of an internet-facing edge appliance.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-19490 is a critical authentication bypass vulnerability affecting NetScaler ADC and NetScaler Gateway appliances ^[1]^[4]. The flaw, classified under CWE-288, enables an unauthenticated attacker to perform session forgery via the SAML HTTP-Redirect binding handler ^[2]^[4]. This vulnerability is significant because it allows remote adversaries to gain unauthorized access to the target system without requiring elevated privileges or user interaction, posing a severe threat to internet-facing infrastructure ^[1].

Exploitation

Active Exploitation: There are reports of active exploitation of this vulnerability in the wild by threat actors targeting edge appliances ^[3].
PoC Availability: Public proof-of-concept (PoC) code exists, specifically demonstrating unauthenticated session forgery via the `/cgi/samlauth` endpoint ^[2].
Attack Prerequisites: Exploitation occurs remotely over the network and does not require authentication or user interaction ^[1].

Affected Products & Patches

Affected Versions:

- NetScaler ADC: Versions 14.1 through 73.32 and 13.1 through 63.21 ^[5]. - NetScaler Gateway: Versions within the same release ranges as the ADC ^[5].

Remediation: The primary fix is to upgrade the vulnerable NetScaler instances to a release and build version that contains the security patch ^[6].

Impact

System Access: Successful exploitation provides an attacker with the ability to bypass authentication mechanisms and potentially perform unauthorized administrative or user-level actions by forging sessions ^[2]^[4].
Business Risk: Internet-facing deployments are at extreme risk, as the appliance serves as an entry point into the network; compromise may lead to full system takeover, lateral movement, and unauthorized access to internal resources protected by the gateway ^[1]^[3].

Sources

CVE-2026-19490: Critical Vulnerability Affecting Citrix ...
CVE-2026-19490, a critical authentication bypass vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. ... On August 19, 2026, a security advisory was published for CVE-2026-19490, a critical authentication bypass vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. The…
CVE-2026-19490 — NetScaler ADC/Gateway SAML ...
Unauthenticated session forgery on Citrix NetScaler ADC / NetScaler Gateway via the SAML HTTP-Redirect binding handler at GET /cgi/samlauth .
CVE-2026-19490: Critical Citrix NetScaler Auth Bypass Actively ...
Attackers are actively exploiting CVE-2026-19490, a critical NetScaler auth bypass. Here's how to detect, contain, and remediate before your edge becomes the entry point.
CVE-2026-19490: Critical Citrix NetScaler Flaw
CVE-2026-19490 is a critical authentication bypass vulnerability in NetScaler ADC and NetScaler Gateway. It is classified as CWE-288 and allows ...
CVE-2026-19490 - Vulnerability Details - OpenCVE
The flaw applies to NetScaler ADC versions from 14.1 through 73.32 and from 13.1 through 63.21, and to NetScaler Gateway versions in the same range. Administrators should check the firmware version of their appliances against these ranges.

🔴 CVE-2026-19490