CISA Warns of Citrix NetScaler Authentication Bypass Vulnerability Exploited in Attacks

CISA added CVE-2026-19490 — a critical authentication-bypass flaw in Citrix NetScaler ADC and Gateway — to its Known Exploited Vulnerabilities catalog after public proof-of-concept code and observed exploitation attempts; agencies must apply mitigations by September 12, 2026. The report lists affected firmware versions and configuration conditions (AAA, Gateway, VPN, SAML), describes honeypot-detected exploitation activity, and urges immediate patching, forensic triage, log review for anomalous authentication events and configuration changes, isolation of impacted appliances, credential rotation, and downstream impact assessment.