Citrix NetScaler auth-bypass flaw reportedly targeted in attacks

Requests reportedly matching a proof of concept

Reports say attackers began targeting CVE-2026-19490, a critical Citrix NetScaler authentication-bypass flaw. The reported activity included requests said to match a public proof-of-concept exploit, while the assessment cited did not confirm successful compromises.

CVE-2026-19490 had been disclosed and patch guidance had been issued, but it had not been reported as targeted in the wild.

The flaw is now reportedly being targeted in exploitation attempts. The reported observations do not establish that any real-world system was successfully compromised.

Attempts are distinct from successful compromise

The reported change is the appearance of exploitation attempts after patch guidance. The observed requests do not prove that real-world systems were successfully compromised.