Citrix published fixed builds for CVE-2026-19490 in NetScaler ADC and NetScaler Gateway, and CISA added the flaw to its Known Exploited Vulnerabilities catalog. CERT-SE says the issue can let an unauthenticated attacker run code remotely when the appliance is configured as a Gateway, including SSL VPN, ICA Proxy, CVPN, or RDP Proxy deployments.
The weakness sits in the internet-facing remote-access service itself, not behind an admin login. In plain terms, the front door that handles VPN and proxy traffic can be abused before authentication, which means a hit on the Gateway role can turn into code execution on the appliance even though the rest of the NetScaler estate may not share that exposure.
For operators, the important boundary is configuration: the urgent risk is concentrated in Gateway-mode installations, especially externally reachable SSL VPN and proxy endpoints. Once a gateway is fixed, the remaining question is whether any public-facing instances were running that role at all, because those are the systems that carried the exploitable path.
AL26-019 - Vulnerabilities impacting Citrix NetScaler ADC and NetScaler Gateway - CVE-2026-19490 and CVE-2026-19489 - Update 1 - Canadian Centre for Cyber Security
AL26-019 - Vulnerabilities impacting Citrix NetScaler ADC and NetScaler Gateway - CVE-2026-19490 and CVE-2026-19489 - Update 1