Citrix has released fixes for a critical authentication bypass in NetScaler ADC and NetScaler Gateway, and security firms warn that exploitation is likely once public exploit code appears.[15]
The flaw, tracked as CVE-2026-3055, allows remote, unauthenticated attackers to gain access to vulnerable appliances without user interaction when certain configurations are exposed to the internet.[15]
According to Citrix, the vulnerability was uncovered during internal security reviews and affects supported NetScaler ADC and Gateway versions commonly deployed as application delivery controllers and VPN gateways.[15]
Citrix rates the issue as critical and urges customers to upgrade to the fixed releases as soon as possible, warning that unpatched systems could provide a straightforward path to compromise.[15]
In its own write-up, Rapid7 said that as of August 19 it had not observed evidence that the newly disclosed Citrix NetScaler vulnerability was being exploited in the wild across its customer base.[1]
However, the firm assessed that attacks targeting the critical authentication bypass are likely once exploit code circulates, echoing Citrix’s call for customers to patch promptly.[15]
The warning comes against a backdrop of repeated exploitation of Citrix NetScaler flaws in recent years, including the CitrixBleed 2 vulnerability in NetScaler ADC and Gateway, tracked as CVE-2025-5777, which has shown signs of active exploitation.[6][7]
Other high-impact NetScaler issues, such as CVE-2025-6543 and earlier bugs like CVE-2023-6548 and CVE-2023-4966, have been used as zero-days and remained under attack even after patches were released.[10][12][13]
Defenders are being urged to inventory all NetScaler ADC and Gateway appliances, prioritize patching of internet-exposed instances, and ensure that management interfaces and VPN portals are not directly reachable from untrusted networks.[10][14][15]
Organizations unable to patch immediately should consider short-term mitigations such as temporarily reducing exposure of NetScaler services, tightening access control lists, and increasing monitoring for anomalous authentication and session activity tied to their gateways.[6][7][15]
References
- CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler …
- Evidence Suggests Exploitation of CitrixBleed 2 Vulnerability
- Active Exploitation of Critical Vulnerabilities in Citrix NetScaler ADC …
- Vulnerabilities in Netscaler ADS and Netscaler Gateway – CERT-EU
- Citrix Netscaler patch for critical CVE bypassed by …
- Critical Citrix NetScaler Flaw Exploited as Zero-Day – SecurityWeek
- CVE-2025-8424: NetScaler ADC Auth Bypass Vulnerability
- Critical Citrix NetScaler Vulnerability Poised for Exploitation …
