GoKawiilAttackers exploit Citrix NetScaler auth-bypass flaw CVE-2026-19490 after PoC leak
Security researchers at Previdian and Belgium's national cyber center report that hackers are actively probing a critical authentication-bypass vulnerability in Citrix NetScaler appliances, tracked as CVE-2026-19490. The flaw affects NetScaler devices configured as AAA virtual servers or Gateways, and exploitation attempts began after a working proof-of-concept was posted online. Citrix patched the issue in mid-August but had not confirmed active exploitation as of its most recent advisory.
GoKawiil's interpretation of the reporting above, not reported fact.
With over 22,000 NetScaler ADC appliances and nearly 1,700 Gateway instances exposed to the internet, unpatched systems present a wide attack surface for remote authentication bypass. Because NetScaler devices often sit at the network perimeter controlling VPN and proxy access, a successful compromise could give attackers a direct path into corporate networks, making rapid patching critical.
- CVE-2026-19490 lets unauthenticated attackers bypass NetScaler authentication remotely.
- Exploitation attempts were detected from IPs in Australia, the US and Germany after a PoC leaked.
- Over 22,000 exposed NetScaler ADC and 1,700 Gateway appliances remain at risk if unpatched.
Yubico YubiKey 5 NFC Security Key — When VPN gateways and AAA servers get hit with authentication bypass bugs, hardware-backed MFA is one of the strongest layers you can add to admin logins. The YubiKey 5 NFC supports FIDO2/WebAuthn, smart card and OTP protocols, works over USB-A or tap-to-authenticate NFC, and needs no batteries or drivers. It's a pocket-sized way to make credential-based attacks on your remote access far harder.
See Yubico YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-04
Published there as: “Critical Citrix NetScaler auth bypass now leveraged in attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.