Citrix has issued security updates for an actively exploited authentication bypass vulnerability in NetScaler ADC and NetScaler Gateway, tracked as CVE-2026-19490 with a CVSS score of 9.3. Classified as an alternate-channel authentication bypass (CWE-288), the flaw resides in the appliance’s SAML HTTP-Redirect binding handler accessible via /cgi/saml endpoints. On systems configured as an AAA virtual server or Gateway (supporting SSL VPN, ICA Proxy, CVPN, or RDP Proxy) with an active SAML action (samlAction), an unauthenticated remote attacker can submit crafted HTTP requests to manipulate assertion verification, forge authenticated sessions, and bypass perimeter access controls without credentials.

Telemetry indicates active in-the-wild exploitation following public proof-of-concept release, prompting CISA to add the vulnerability to its Known Exploited Vulnerabilities catalog. Threat actors leverage forged sessions to gain direct access to internal corporate networks and virtual desktop infrastructure, evading multi-factor authentication. Cloud Software Group released fixes in NetScaler versions 14.1-73.32, 13.1-63.21, and corresponding FIPS builds. Administrators must apply updates immediately, audit ns.conf for SAML configurations, and inspect authentication logs for unauthorized session creation.

Why it matters:

• Perimeter trust boundary collapse: Pre-authentication session forgery in NetScaler gateways completely subverts zero-trust boundary controls, granting remote unauthenticated adversaries direct access to internal corporate networks and VDI workloads while completely bypassing multi-factor authentication.
• Immediate edge remediation and session audit: Enterprise security teams must immediately apply vendor firmware updates across exposed ADC instances, restrict administrative and gateway ingress paths, and audit session logs for forged assertions originating from unauthorized external IPs.