Cloud Software Group bulletin CTX696939 (19 August 2026, Critical) covers an authentication bypass using an alternate path in customer-managed NetScaler ADC and NetScaler Gateway. CVSS v4.0 9.3. It applies when the appliance is a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server; on some later 14.1/13.1 builds only when a SAML action is also configured. Not Citrix-managed cloud.

No workaround. Patch to 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS, or 13.1-37.277 FIPS/NDcPP, as applicable. Secure Private Access Hybrid using customer-managed NetScaler also needs those builds.

Updated 4 Sep 2026 (BleepingComputer, 4 September 11:25 pm Perth): BleepingComputer reports Previdian honeypot sensors saw requests matching a public PoC on 3 September from three source IPs geolocated to Australia, the United States and Germany — evidence of exploitation attempts, not confirmed successful compromise of production systems.

The Centre for Cybersecurity Belgium also warned of exploitation attempts the same week. Citrix’s August bulletin had not yet flagged active exploitation.

Updated 7 Sep 2026 (WA SOC): WA SOC advisory 20260907003 (7 September 2026, TLP:CLEAR) covers CVE-2026-19490 at CVSS 9.3 for the same build floors, and reports no exploitation on Western Australian Government networks at the time of writing. Updated 9 Sep 2026 (CISA): CISA added CVE-2026-19490 to the Known Exploited Vulnerabilities catalog on 9 September 2026 (due 12 September 2026 for FCEB under BOD 26-04, including forensic triage requirements).

Patch floors unchanged: 14.1-73.32 / 13.1-63.21 and FIPS mates.

Correction (26 Oct 2026): the BleepingComputer, WA SOC and CISA reports, all later than Citrix's 19 August bulletin, now carry Updated lines; the card date stays 19 August 2026. The WA SOC and CISA links now point to the addresses those pages have moved to. (source: Citrix; BleepingComputer; WA SOC; CISA)