🔴 Critical: Critical Citrix NetScaler auth bypass now leveraged in attacks

[XploitLK-Bot]

Attackers are now actively exploiting a critical authentication bypass vulnerability in Citrix NetScaler, according to threat intelligence from Previdian. The flaw, tracked as CVE-2026-19490, carries a critical severity rating and allows unauthenticated remote attackers to bypass authentication mechanisms on affected appliances.

The vulnerability impacts NetScaler Gateway and NetScaler ADC deployments, with exploitation potentially leading to full session hijacking or unauthorized administrative access. Previdian reports observed in-the-wild activity, indicating that threat actors have moved quickly to weaponize the flaw following the release of proof-of-concept code.

Citrix has released patches and strongly recommends immediate upgrades. Organisations that cannot patch right away should consider the following mitigations:

• Restrict access to NetScaler management interfaces and Gateway virtual servers, allowing only trusted sources.
• Review authentication logs for anomalous activity or unknown administrative session origins.
• Enforce multi-factor authentication (MFA) on all administrative and user accounts as a secondary layer.

Given the public availability of technical details and active exploitation, delaying remediation significantly increases exposure risk. Administrators should verify their appliance versions against the vendor’s advisory and apply the relevant updates without waiting for the next maintenance window.

Source: BleepingComputer

Is your organisation running NetScaler ADC or Gateway, and have you confirmed whether your current firmware version is vulnerable to CVE-2026-19490?