Critical Vulnerability in Citrix NetScaler ADC and Gateway (CVE-2026-19490)
Executive Summary
On August 19th, Citrix published a security advisory detailing a critical authentication bypass vulnerability in their NetScaler ADC and NetScaler Gateway products. The vulnerability can be exploited remotely and without credentials, and given the typical deployment of these products, can provide threat actors initial access into targeted organizations’ networks.
The vulnerability was discovered and reported by third party security researchers, and no technical details were publicly provided at time of disclosure. Additionally, at time of writing there are no public reports of exploitation in-the-wild. However, given the risk presented by a compromise of this type of product, Beazley Security strongly recommends affected organizations update their systems as soon as possible.
Affected Systems and Products
This vulnerability only affects customer-managed NetScaler ADC and Gateway devices; the Citrix-managed cloud services had their updates applied at time of disclosure. Affected clients should also review the official Citrix advisory, as it further details specific configurations necessary to be vulnerable:
- 14.1-43.56 or later: Applicable only when configured with a SAML action AND NetScaler is configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver
- 14.1-66.68-FIPS or later: Applicable only when configured with a SAML action AND NetScaler is configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver
- 14.1-43.55 or earlier: Applicable when configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy ) or AAA vserver
- 13.1-61.28 or later: Applicable only when configured with a SAML action.
- 13.1-61.27 or earlier: Applicable when configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver
- 13.1 FIPS: Applicable when configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver.
Additionally, clients can inspect their NetScaler configurations for the following strings to determine if their products meet the preconditions:
SAML action configuration
"add authentication samlAction.*"Auth or VPN vserver
"add authentication vserver .*"Or
"add vpn vserver .*"Mitigations and Workarounds
The official advisory published by Citrix lists no recommended workarounds or mitigation steps.
Patches
Security update patches were made available at time of disclosure and can be applied via normal device update procedures. Citrix also provides technical assistance through their support portal.
Technical Details
No technical details were provided with the advisory, however the standard metrics and documentation provided to NIST indicate the vulnerability is an “authentication bypass using an alternate path”, accessible via external network connection and exploitable without using existing credentials or requiring victim interaction.
Given the affected products are used as VPN gateways it can be inferred an exposed endpoint was not sufficiently secured.
How Beazley Security is Responding
Beazley Security is monitoring client perimeter devices through our Exposure Management Platform to identify impacted devices and support organizations in remediation of any issues found.
We are also conducting threat hunts across our MDR environment to detect potential exploitation attempts against our clients.
If you believe your organization may have been impacted by this attack campaign and need support, please contact our Incident Response team.
Sources
Aware of an incident impacting your industry? Let us know: