Attacks on a Critical Authentication-Bypass Flaw in Citrix NetScaler Have Begun

Previdian, a company specializing in vulnerability analysis, has reported the start of attacks exploiting a critical vulnerability in Citrix NetScaler. The flaw, assigned the identifier CVE-2026-19490, allows unauthenticated attackers to bypass authentication remotely — provided the device is configured as a AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy). Whether it can be exploited depends on the version of the NetScaler firmware and the presence of a configured SAML Action.

There Was a Patch, Now Come the Attacks

Citrix closed the vulnerability in mid-August and strongly urged administrators to review the official security bulletin for NetScaler ADC and NetScaler Gateway, assess whether their deployments were affected, and update vulnerable devices to the recommended builds as soon as possible.

In its August 19 bulletin, the company had not yet flagged the vulnerability as being actively exploited. However, as Previdian founder and security researcher Ryan Dewhurst told BleepingComputer, the situation changed after a “plausible” PoC exploit was published online. According to him, on September 3 one of the company's sensors that monitor NetScaler recorded requests matching this PoC coming from three different IP addresses — in Australia, the United States, and Germany.

Dewhurst stresses caution in his assessments: the observed activity points to exploitation attempts, but does not confirm the successful compromise of real-world systems.

Warnings From Regulators

The Centre for Cybersecurity Belgium (NCC-BE) also warned of attempts to exploit CVE-2026-19490, urging administrators to update all vulnerable Citrix NetScaler devices on their networks as a priority.

The scale of the potential threat is hard to gauge. The Shadowserver monitoring service tracks more than 22,000 internet-facing NetScaler ADC devices and nearly 1,700 Gateway instances, but it is unknown how many of them are honeypots, have vulnerable configurations, or have already received updates.

Not the First Time

For Citrix, this is already a familiar scenario. In March, the company called for two other NetScaler vulnerabilities (CVE-2026-3055 and CVE-2026-4368) to be patched — literally days before they began to be exploited. One of them, CVE-2026-3055, was added a week later by the U.S. agency CISA to its catalog of actively exploited vulnerabilities, with a directive for federal agencies to remediate it within three days.

Since November 2021, CISA has flagged a total of 23 Citrix vulnerabilities as exploited in real-world attacks, six of which were used by ransomware operators.

Source: Bleeping Computer