CVE-2026-19490NetScaler Gateway and AAA authentication bypass with SAML configured

What broke

Cloud Software Group disclosed two flaws in NetScaler ADC and NetScaler Gateway on August 19, 2026. CVE-2026-19490 (CVSS 9.3, improper authentication) is an authentication bypass. CVE-2026-19489 (CVSS 8.8) is a memory overflow shipped in the same bulletin.

The bypass reaches appliances configured as a Gateway virtual server (SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. On the current builds the vendor scopes it further: exploitable when a SAML action is configured on that virtual server. Earlier builds in each branch are affected without the SAML prerequisite, so version matters more than configuration for anything not recently patched.

Affected: 14.1 before 14.1-73.32 and 13.1 before 13.1-63.21, plus the corresponding FIPS and NDcPP builds. Fixed in 14.1-73.32 and 13.1-63.21. No public exploitation at disclosure; CISA has since confirmed exploitation and added it to the Known Exploited Vulnerabilities catalog on September 9, 2026.

Why it matters

A NetScaler running Gateway or AAA is not a load balancer with a login page bolted on. It is the authentication boundary for remote access and, when AAA is in play, a policy decision point for the applications behind it. Bypass authentication there and the MFA policy, the device posture check, and the conditional access rules all become decorative, because the request arrives on the far side of the thing that was supposed to evaluate them.

The reason to treat this one with more urgency than its quiet disclosure suggested was the track record, and the track record held. CVE-2023-4966, CitrixBleed, turned into mass session hijacking and ransomware within weeks of disclosure, and the pattern repeated with CitrixBleed 2. Internet-facing identity appliances get exploited quickly because the payoff is a session rather than a shell, and a stolen session survives a password reset.

What to do

• Upgrade to 14.1-73.32 or 13.1-63.21. Version 12.1 and 13.0 are end of life and receive no fix; those need migration, not patching.
• If you cannot patch immediately, confirm whether a SAML action is bound to your Gateway or AAA virtual servers, and understand that removing it is a stopgap only on the newer builds.
• Do not expose the management interface (NSIP) to untrusted networks. It should not be reachable from the internet under any configuration.

After you patch

Patching an authentication bypass on a gateway does not evict anyone already through it, which is the step CitrixBleed taught the hard way.

• Terminate all active sessions, ICA and AAA alike, and invalidate persistent session cookies. kill aaa session -all and kill icaconnection -all after the upgrade, not before.
• Rotate every credential the appliance holds: LDAP and RADIUS bind accounts, SAML signing keys and certificates, and any API keys in the configuration.
• Enumerate local appliance accounts and administrator sessions created during the exposure window.
• Hunt downstream. Look for authenticated activity in the applications behind the gateway from addresses that never completed a login, and for session cookie theft patterns in application logs.

Sources

• NVD: CVE-2026-19490
• NetScaler security bulletins
• The Hacker News, August 20, 2026