Citrix NetScaler and Cisco FMC: 2 Authentication Bypasses in CISA KEV

On September 9, 2026, CISA added two authentication bypasses to its KEV catalog on the same day, with a three-day remediation deadline. Both target security appliances, and both fall under exactly the same weakness: authentication bypass using an alternate path or channel (CWE-288).

NVD has published no score, vector or version list for either at the time of writing. I'm relying solely on the CISA descriptions, and I won't invent a fixed version number: that requires the Citrix and Cisco advisories.

What "Alternate Path" Means

The CWE-288 phrasing is worth understanding, because it explains why this flaw class is both common and durable.

It isn't "authentication is broken". It's: there is a second route to the same functionality, and that route checks nothing.

Concretely, a product exposes a web interface protected by a robust, audited, tested authentication portal — while also retaining a legacy endpoint, an internal API, a diagnostic channel or a URL variant that reaches the same code without passing through the check.

That's why these flaws survive security reviews: the check exists and works. Nobody removed it. You simply don't have to go through it.

This is the third time this summer we've documented this pattern on security consoles, after Check Point SmartConsole and Cisco FMC in July. That's no longer a run of incidents, it's a trend.

CVE-2026-19490 — Citrix NetScaler ADC and Gateway

Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.

The exploitation condition is explicit, and it's the first thing to check: the flaw only affects appliances configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy).

In other words: a NetScaler used purely as a load balancer is out of scope. A NetScaler serving as a remote access portal is in scope — and that's by far the more common deployment.

Why it's severe

A NetScaler Gateway is the access control. It's the front door for remote staff into the internal network, and as such it is:

• internet-exposed by definition — that's its purpose
• positioned ahead of everything else: crossing it puts you on the right side of the perimeter
• the point every remote user's credentials pass through

Citrix has heavy history here: CVE-2019-19781 and CVE-2023-4966 ("Citrix Bleed") both drew mass exploitation campaigns, the latter serving as the initial vector for several major ransomware operations. Operators know this product, have reusable tooling, and scan continuously.

The three-day CISA deadline reflects that history.

CVE-2026-20079 — Cisco Secure Firewall Management Center

Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.

Here the chain runs all the way and the description leaves no ambiguity: authentication bypass, then script execution, then root access on the underlying system. Without authentication.

Why FMC is worse than a firewall

FMC isn't a filtering device, it's the console that administers the filtering devices. Compromising it yields:

• rewriting security policy across every managed firewall — an attacker doesn't need to evade the firewall, they ask it to let them through
• disabling logging, erasing visibility while they operate
• access to the certificates and keys used for TLS inspection, where enabled
• a pivot position toward every managed appliance

This is the second FMC authentication bypass we've covered in two months. The first already led to root.

What to Check

Both vendor advisories carry the fixed versions; I don't have them and won't guess.

Citrix — check the version and, above all, the configuration:

show ns version

# The flaw only affects these configurations
show vserver | grep -i "SSL_VPN\|AAA"
show aaa vserver

If no AAA virtual server or Gateway is configured, you're outside CVE-2026-19490's scope — but verify it rather than assuming.

Cisco FMC:

show version

Or in the interface: Help → About.

Detection

Authentication bypasses leave a characteristic trace: privileged actions with no corresponding login session. That's what to hunt first, more than the exploitation request itself.

Citrix NetScaler

# Authentication logs
cat /var/log/ns.log | grep -iE "aaa|login|sslvpn"

Signals:

• Sessions established with no preceding authentication failure or success in the log
• Sessions from geolocations or time windows inconsistent with your remote user population
• Account creations or configuration changes with no documentation
• Modified files under /var/netscaler/ and /flash/nsconfig/

Cisco FMC

• Unknown administrator accounts
• Policy changes not tied to a change request
• Configuration deployments to managed devices outside your usual windows
• Logging interruption — an unexplained gap is itself an indicator
• Shell access on the appliance, which should be exceptional and traced

The cross-cutting check

On both products, compare current configuration against a trusted earlier backup. An attacker who gains root changes something; it's that delta which shows, not their arrival.

Mitigation

1. Apply the vendor fixes — the deadline has passed

Both CISA deadlines were September 12. With an unauthenticated authentication bypass on an exposed appliance, this isn't a maintenance-window matter.

2. Citrix: reduce the surface immediately

If updating can't be immediate:

• Restrict Gateway access by geolocation or address ranges, where your usage allows
• Multi-factor authentication on the AAA virtual server — it doesn't block a bypass that short-circuits authentication, but it limits the use of already-stolen credentials
• Invalidate all active sessions after updating: that's the Citrix Bleed lesson, where stolen session tokens stayed valid after the patch

That last point matters and is routinely missed: patching does not disconnect an attacker who is already in.

3. Cisco FMC: remove the exposure

A firewall management console has no reason to be internet-reachable. If administrators access it remotely, route that through a VPN and a dedicated admin workstation.

4. If you conclude there was a compromise

1. Isolate the appliance, but anticipate the impact: taking down a NetScaler Gateway takes down remote access for the whole organisation
2. Compare configuration against a validated earlier backup
3. Revoke every session and rotate credentials — admin accounts, service accounts, shared secrets
4. On FMC, audit deployed policy on each managed firewall: that's where the change that matters lives
5. Treat TLS inspection certificates as exposed if they were present on the device

Why Continuous Monitoring of Security Appliances Matters

Security appliances share a trait that makes them hard to maintain: they're critical, exposed, and their downtime is immediately visible — which discourages updates outside a planned window. Rebooting a NetScaler Gateway means the whole organisation loses remote access for a few minutes. The result: they're often the least frequently patched devices in the estate, while being the most exposed.

With cveo.tech, inventory your firewalls, VPN gateways and management consoles with exact versions, and get automatic alerts whenever a critical CVE — particularly a KEV-listed one — affects one of them.