Citrix NetScaler Authentication Bypass Flaw Exploited in the Wild

According to vulnerability intelligence firm Previdian, attackers have begun leveraging a critical-severity authentication bypass flaw in Citrix NetScaler appliances. The vulnerability, identified as CVE-2026-19490, allows unauthenticated remote attackers to bypass authentication on affected NetScaler devices. Reports indicate that exploitation of CVE-2026-19490 began in the wild around September 2026.

The affected products include Citrix NetScaler appliances used for application delivery and load balancing. The exact scope of affected firmware versions and the specific methodology of the authentication bypass remain under investigation. Previdian's report notes that while exploitation is confirmed in the wild, detailed technical information about the attack chain and threat actor groups involved is still emerging.

Citrix security teams are reportedly working on patches and security updates. Security advisories recommend that organizations using NetScaler apply the latest available firmware versions and monitor for official Citrix advisories addressing CVE-2026-19490. The full extent of impacted systems and the nature of active exploitation campaigns are still being assessed.