Patch todayCitrix NetScalerFirewalls, VPNs & network gear

A Citrix NetScaler login bypass has no workaround

Who's affected: Organizations using NetScaler ADC or Gateway for VPN or remote access, in certain setups.
Under attack?: Yes, starting soon after exploit research went public.
What to do: Upgrade; Citrix says there's no workaround. If you can't upgrade right away, limit access to known IP addresses and require multi-factor sign-in.
Fixed in: 14.1-73.3213.1-63.21FIPS 13.1-37.277
CISA deadline: Federal agencies must fix this by Sep 12, 2026. Everyone else should treat that as a ceiling, not a target.

CVE-2026-19490Severity score 9.3/10Chance of attack in 30 days: 33% (EPSS)Listed Sep 9, 2026Source: Resecurity ↗

Citrix scorecard: every exploited Citrix flaw →

Client notice ready to send

Fill in the bracketed parts, then paste into an email to your clients or team.

Subject: Security update: Citrix NetScaler

Hi [Client name],

Attackers are actively exploiting a security flaw in Citrix NetScaler.

Who's affected: Organizations using NetScaler ADC or Gateway for VPN or remote access, in certain setups.

What we're doing: [We're checking your systems now and will have the fix in place by DATE.]

What to do: Upgrade; Citrix says there's no workaround. If you can't upgrade right away, limit access to known IP addresses and require multi-factor sign-in.

Fixed in: 14.1-73.32, 13.1-63.21, FIPS 13.1-37.277
Reference: CVE-2026-19490 – https://www.resecurity.com/en/blog/article/cisa-kev-alert-cisco-citrix-and-fortinet-vulnerabilities-under-active-exploitation

We'll confirm once everything is updated. Reply here with any questions.

[Your name]

A Citrix NetScaler login bypass has no workaround

Also under attack in Firewalls, VPNs & network gear