Authentication Bypass Vulnerability in Citrix NetScaler ADC and Gateway

Catalog analysis: CISA added this entry on September 09, 2026. The entry reflects catalog information retrieved on September 09, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-19490 is an authentication bypass vulnerability (CWE-288) affecting Citrix NetScaler ADC and NetScaler Gateway. The flaw involves an alternate path or channel that could allow an unauthenticated remote threat actor to circumvent authentication mechanisms. Because these appliances often serve as the primary entry point for remote clinicians and administrators, a bypass of this nature could grant unauthorized access to internal networks containing electronic Protected Health Information (ePHI).

Exposure and applicability

This vulnerability does not affect all NetScaler installations. It specifically applies to appliances configured in the following roles:
* AAA virtual servers
* Gateways, including those used for SSL VPN, ICA Proxy, CVPN, or RDP Proxy

Healthcare organizations that rely on these configurations for secure remote access to Electronic Health Record (EHR) systems or clinical applications are at higher risk. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on September 9, 2026, indicating active exploitation in the wild.

Remediation priorities

Our analysis suggests that healthcare security leaders should prioritize the following actions based on their specific deployment:

1. Configuration Audit: Immediately identify if NetScaler appliances are configured as AAA virtual servers or Gateways. If the appliance is not used in these capacities, the immediate risk from this specific CVE is reduced.
2. Apply Vendor Mitigations: For vulnerable configurations, apply the mitigations provided by Citrix. This is the primary method to prevent initial unauthorized access.
3. Forensic Triage: Because this vulnerability has been observed in the wild, organizations should perform forensic triage to determine if their environment has already been compromised. This is a detection and recovery priority rather than a prevention step.
4. Exposure Review: Evaluate the internet exposure of all NetScaler assets to ensure that only necessary services are reachable from the public web, which could reduce the likelihood of discovery by threat actors.

How to validate remediation

To verify that the risk has been reduced, administrators should:
* Confirm through system logs and version checks that vendor-supplied mitigations have been successfully applied to all identified AAA and Gateway configurations.
* Review forensic triage results to ensure no unauthorized accounts or persistence mechanisms were established prior to patching.
* Coordinate with network teams to verify that the appliance is only accessible via authorized paths, reducing the attack surface.

Limits and open questions

Applying mitigations could reduce the likelihood of an authentication bypass but does not guarantee total immunity from all forms of intrusion. It remains unknown whether this vulnerability has been utilized in specific ransomware campaigns targeting the healthcare sector. Additionally, while CISA has established a deadline for federal agencies, private healthcare providers must determine their own patching timelines based on their internal risk management processes and HIPAA Security Rule obligations.

Source and editorial note

CVE-2026-19490: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability · Source date: September 09, 2026 · Retrieved September 09, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a healthcare security assessment