CVE-2026-19490: Critical Citrix NetScaler Authentication Bypass Exposes Enterprise Gateways

## Executive summary Cloud Software Group has released patches for CVE-2026-19490, a critical (CVSS 9.3) authentication bypass in NetScaler ADC/Gateway that can allow unauthenticated remote attackers to access protected services when specific Gateway/AAA or SAML configurations are present; affected 13.1 and 14.1 branches must be upgraded to the vendor's fixed builds and administrators should prioritize internet-facing appliances, review authentication/SAML logs for anomalous sessions, and preserve historical logs for forensic review.