{
 "Event": {
  "uuid": "dda27c44-0117-5591-abf6-2cffa8099661",
  "info": "Citrix NetScaler Authentication Bypass CVE-2026-19490 Under Active Attack",
  "date": "2026-09-03",
  "threat_level_id": "1",
  "analysis": "2",
  "distribution": "3",
  "published": false,
  "Orgc": {
   "name": "SecurityStudies.info"
  },
  "Tag": [
   {
    "name": "tlp:clear"
   },
   {
    "name": "securitystudies:status=\"curated\""
   },
   {
    "name": "securitystudies:type=\"other\""
   },
   {
    "name": "misp-galaxy:country=\"australia\""
   },
   {
    "name": "misp-galaxy:country=\"united states\""
   },
   {
    "name": "misp-galaxy:country=\"germany\""
   },
   {
    "name": "misp-galaxy:country=\"belgium\""
   },
   {
    "name": "misp-galaxy:sector=\"Government\""
   },
   {
    "name": "misp-galaxy:sector=\"Financial Services\""
   },
   {
    "name": "misp-galaxy:sector=\"Healthcare\""
   },
   {
    "name": "misp-galaxy:sector=\"Technology\""
   }
  ],
  "Attribute": [
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://securitystudies.info/cyber/incidents/citrix-netscaler-authentication-bypass-cve-2026-19490-under-active-attack/",
    "comment": "SecurityStudies.info entry",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://www.bleepingcomputer.com/news/security/hackers-target-critical-citrix-netscaler-auth-bypass-in-attacks/",
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "text",
    "category": "Other",
    "value": "Security firm Previdian reported that on 3 September 2026 one of its NetScaler sensors received requests matching public proof-of-concept code from three distinct source IPs geolocated to Australia, the United States and Germany. CVE-2026-19490 permits unprivileged remote attackers to bypass authentication on NetScaler ADC and Gateway appliances configured as AAA virtual servers or gateways, depending on firmware version and SAML Action configuration. Belgium's National Cybersecurity Coordination Centre issued a parallel warning, and more than 22,000 NetScaler ADC appliances are tracked as internet-exposed. Citrix released fixed builds in mid-August 2026.",
    "comment": "summary",
    "to_ids": false
   }
  ]
 }
}