CISA Orders Federal Agencies to Patch a Critical NetScaler Flaw by September 12

The Cybersecurity and Infrastructure Security Agency has confirmed that a critical authentication bypass flaw in Citrix NetScaler ADC and NetScaler Gateway appliances is under active exploitation, and it is giving federal civilian agencies until September 12 to patch it, according to SecurityWeek.

The flaw, tracked as CVE-2026-19490, carries a CVSS v4.0 base score of 9.3 and is classified as CWE-288, authentication bypass using an alternate path or channel. According to Citrix’s own security bulletin, it affects appliances configured as an AAA virtual server or as a Gateway for SSL VPN, ICA Proxy, CVPN, or RDP Proxy traffic. On the newest NetScaler builds, the bug only applies when a SAML action is also configured; on older builds, any Gateway or AAA vserver configuration is enough to be exposed. Citrix, now part of Cloud Software Group, credited Samarth Vashisht of JPMorgan Chase’s penetration-testing team with reporting the issue.

From patch to exploitation in three weeks

Citrix published the fix on August 19 in security bulletin CTX696939, alongside a second, lower-severity flaw (CVE-2026-19489, a CVSS 8.8 memory overflow that can crash appliances running SIP ALG on a Large Scale NAT configuration). The bulletin lists no workarounds for either bug: the only fix is upgrading to NetScaler ADC and Gateway 14.1-73.32 or 13.1-63.21 or later, with matching builds for the FIPS and NDcPP variants.

On the day the patch shipped, Rapid7 said it had not yet observed CVE-2026-19490 being exploited but urged customers to patch on an emergency basis anyway, noting that “Citrix products are high-value targets that tend to quickly see exploitation in the wild.” That assessment held for about two weeks. A proof-of-concept exploit appeared on GitHub around September 2, and vulnerability intelligence firm Previdian said its NetScaler sensors picked up matching requests the very next day.

“On 3 September, one of our NetScaler sensors received requests matching the PoC from three distinct source IPs, geolocated to Australia, the United States and Germany,” Previdian founder Ryan Dewhurst told BleepingComputer, adding that this shows evidence of exploitation attempts but does not confirm that any system was successfully compromised. Belgium’s national cybersecurity coordination center also warned on September 4 that it was tracking exploitation attempts against the flaw and urged organizations to prioritize patching.

CISA’s three-day clock

CISA added CVE-2026-19490 to its Known Exploited Vulnerabilities catalog on September 9 and, under Binding Operational Directive 26-04, ordered federal agencies to patch or otherwise mitigate exposed appliances by September 12. The KEV entry also flags the vulnerability under CISA’s forensic-triage requirements, meaning agencies with exposed, internet-facing NetScaler deployments are expected to look for signs of prior compromise rather than treat patching alone as sufficient.

NetScaler appliances are a common perimeter chokepoint, handling load balancing, SSL offloading, and remote-access VPN traffic for large enterprises, which is part of why Citrix flaws draw fast attention from attackers once they become public. Internet scanning service Shadowserver currently tracks more than 22,000 exposed NetScaler ADC instances and nearly 1,700 exposed Gateway instances, though it has no visibility into how many of those are already patched, honeypots, or genuinely vulnerable. CISA has added 23 separate Citrix vulnerabilities to its KEV catalog since November 2021, and six of those have gone on to be used in ransomware attacks, according to BleepingComputer’s reporting. Two other NetScaler flaws that Citrix patched in March, CVE-2026-3055 and CVE-2026-4368, were already being exploited within days.

Organizations running customer-managed NetScaler ADC or NetScaler Gateway appliances configured as a Gateway or AAA virtual server should treat this as an emergency patch, not a routine one: check the exact preconditions in Citrix’s bulletin against their own configuration, upgrade to a fixed build, and review logs for signs of exploitation predating the patch.