Exploitation of Citrix NetScaler Authentication Bypass Vulnerability CVE-2026-19490

On September 4, 2026, it was reported that threat actors are actively targeting a critical authentication bypass vulnerability in Citrix NetScaler, tracked as CVE-2026-19490. This flaw allows unauthenticated attackers to bypass authentication controls on affected NetScaler ADC and Gateway deployments, potentially granting access to sensitive applications. The vulnerability was publicly disclosed on August 19, 2026, and a proof-of-concept exploit was released on September 3, 2026. Citrix has urged organizations to apply security updates and monitor for unauthorized access. The CVE has a CVSS v4.0 score of 9.3, indicating its critical severity. Organizations using NetScaler products are advised to assess their configurations and apply patches immediately. The Australian Cyber Security Centre has issued warnings, although no specific sectors are currently reported as targeted.

Key Points: • CVE-2026-19490 allows unauthenticated access to Citrix NetScaler systems. • Public proof-of-concept exploit code was released on September 3, 2026. • Citrix released patches for the vulnerabilities on August 19, 2026.