The short answer
- Affected
- NetScaler ADC and NetScaler Gateway builds below the first fixed build for their release, when the precondition below is met.
- Fixed in
- 14.1-73.32 / 13.1-63.21First fixed builds for 14.1 / 13.1. All releases in the table below.
- Current safe build
- 14.1-73.46 / 13.1-64.29Includes later fixes. Advisory data as of 2026-10-15.
- CISA KEV
- Added 2026-09-09, federal due date 2026-09-12. Known ransomware use: Unknown.
- Forensic triage
- Yes. CISA flags this CVE for forensic triage: preserve evidence (snapshot, logs) before patching.
- CVSS
- 9.3 (CVSS v4.0, vendor score in CTX696939)
- Preconditions
- Gateway or AAA vserver; on 14.1-43.56+ / 13.1-61.28+ a SAML action (add authentication samlAction) is also required
- Session kill advised
- No. The bulletin does not call for session termination.
Fixed builds from the Citrix® security bulletin CTX696939
| Release | First fixed build | Current safe build |
|---|---|---|
| NetScaler 14.1 | 14.1-73.32 | 14.1-73.46 |
| NetScaler 14.1 FIPS | 14.1-73.32 FIPS | 14.1-73.46 FIPS |
| NetScaler 13.1Past end of maintenance | 13.1-63.21 | 13.1-64.29 |
| NetScaler 13.1 FIPS/NDcPPPast end of maintenance | 13.1-37.277 FIPSConservative: the bulletin gives no FIPS build for the samlAction precondition change, so Gateway/AAA alone is treated as exposure. | 13.1-37.283 FIPS |
FIPS and NDcPP builds have separate fixed builds: see the table and the bulletin.
What it is
“Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability”
Our advisory data, taken from CTX696939, summarises it as: Authentication bypass using an alternate path. Vulnerability class: authentication bypass (CWE-288). Precondition: Gateway or AAA vserver; on 14.1-43.56+ / 13.1-61.28+ a SAML action (add authentication samlAction) is also required.
For the full description, read the CVE.org record for CVE-2026-19490 and the vendor bulletin.
Am I affected?
Two things must both be true: the appliance runs a build below the fixed build for its release (see the table above), and its configuration meets the precondition: Gateway or AAA vserver; on 14.1-43.56+ / 13.1-61.28+ a SAML action (add authentication samlAction) is also required. Find the build with show ns version on the CLI.
Enter your build to check it against CVE-2026-19490 and every other NetScaler CVE in our data. The checker runs in your browser and never connects to any appliance.
Open the checker with CVE-2026-19490 highlightedHow to patch
Evidence first. CISA flags CVE-2026-19490 for forensic triage. Preserve evidence (snapshot, logs) before you patch, then upgrade, then run the IoC checks below.
- Choose the target build: at least
14.1-73.32on 14.1 or13.1-63.21on 13.1. Prefer the current safe build (14.1-73.46 / 13.1-64.29), which also includes later fixes. FIPS and NDcPP appliances need their own fixed build from the table above. - Upgrade every node. In an HA pair, upgrade the secondary first, fail over, then upgrade the former primary. Our HA pair upgrade runbook walks through each step and the rollback.
- Confirm the build on each node with
show ns version, then work through the post-patch steps below.
13.1 is past end of maintenance, so plan the move to 14.1 while you are in the change window. Check the release dates in our NetScaler end-of-life guide.
If you cannot upgrade yet
- Global Deny List signatures via NetScaler Console for builds above 14.1-60.52 / 13.1-63.16 (vendor: 'Workarounds: None')
Interim measures reduce exposure; only the fixed build removes the vulnerability.
After patching
Steps in the vendor bulletin
vendor bulletinThe bulletin does not call for session termination. It lists no post-patch steps beyond the upgrade.
Hunt for compromise
Upgrading does not remove an existing compromise. These indicators and tools are published guidance; we do not run them for you.
Precondition strings
- add authentication samlAction
- add authentication vserver
- add vpn vserver
Source: CTX696939
Timeline
- Vendor bulletin CTX696939 published with fixed builds
- Added to the CISA Known Exploited Vulnerabilities catalog
- CISA federal remediation due date
Related CVEs
- CVE-2026-19489SIP ALG flaw on LSN groupsNot in KEVSame bulletin (CTX696939)
Sources
- Vendor bulletin: CTX696939, NetScaler ADC and Gateway security bulletin for CVE-2026-19489 and CVE-2026-19490 (published 2026-08-19)
- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-19490
- CISA KEV catalog JSON feed, version 2026.10.15: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Last verified 2026-10-15 against CISA KEV and CVE.org. Advisory data version 2026.10.15-1.