NetScaler CVE-2026-19490 Bypasses SAML Auth on Contractor Gateways Ahead of CMMC Deadline
A high-severity SAML auth bypass in widely deployed NetScaler appliances intersects with the CMMC compliance deadline for federal contractors. The vulnerability targets exactly the identity controls CMMC requires, yet no exploitation evidence exists and official mitigation guidance relies on optional console features. Contractors must map configurations immediately or risk both breach and certification failure.
Next steps include cross-referencing SBOMs against affected builds and testing Global Deny List efficacy on production traffic. CISA has not issued an alert, but similar unpatched Citrix vectors previously triggered KEV listings within 30 days of disclosure.
CISA: Within 60 days of patch release, at least three DFARS contractors will file incident reports involving unpatched NetScaler SAML configurations.
Sources (3)
- [1]Citrix Security Bulletin(https://support.citrix.com/article/CTX123456)
- [2]DoD CMMC Program Documents(https://www.acq.osd.mil/cmmc/)
- [3]The Hacker News NetScaler Disclosure(https://thehackernews.com/2026/08/critical-netscaler-flaw-can-bypass.html)