Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

CVE-2026-19490 is a critical authentication bypass vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway. The flaw involves an alternate path or channel that allows unauthenticated remote attackers to bypass authentication controls. It is exploitable when the appliance is configured as an AAA virtual server or as a Gateway supporting SSL VPN, ICA Proxy, CVPN, or RDP Proxy. CISA has flagged this vulnerability under BOD 26-04, which prioritizes security updates based on risk. Forensics triage requirements have also been published as part of BOD 26-04 implementation guidance. Citrix has released a security advisory (CTX696939) with remediation details. The vulnerability poses significant risk to enterprise environments relying on Citrix for remote access and identity management. Organizations are urged to apply patches immediately and review access logs for signs of exploitation.