CVE-2026-19490
CRITICAL CISA KEV
ACT NOW
Priority: 3.04
BB Relevance:
85/100
Published: 2026-08-19
Modified: 2026-10-26
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
X
AT:
None
VC:
High
VI:
High
VA:
High
Description
Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.
CISA Known Exploited Vulnerability
Vendor / Product
Citrix — NetScaler
Date Added
2026-09-09
Remediation Due
2026-09-12
https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-19490
Weakness Classification (1)
Affected Software (7)
| Vendor | Product | Version |
|---|---|---|
| citrix | netscaler_application_delivery_controller | 13.1 – 13.1-37.277 |
| citrix | netscaler_application_delivery_controller | 13.1 – 13.1-37.277 |
| citrix | netscaler_application_delivery_controller | 13.1 – 13.1-63.21 |
| citrix | netscaler_application_delivery_controller | 14.1 – 14.1-73.32 |
| citrix | netscaler_application_delivery_controller | 14.1-66.68 – 14.1-73.32 |
| citrix | netscaler_gateway | 13.1 – 13.1-63.21 |
| citrix | netscaler_gateway | 14.1 – 14.1-73.32 |
References & Advisories (2)
Vendor Advisory
US Government Resource