CVE-2026-19490: listed in the CISA KEV catalog

CVE-2026-19490 · KEV 2026-09-09 · patch available

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.

Is CVE-2026-19490 exploited?

• Listed in the CISA KEV catalog on 2026-09-09.
• Federal remediation due 2026-09-12.
• Past that date by 31 days.
• Public exploit code: none found in monitored sources.

Which products and versions are affected?

• Citrix Systems · NetScaler · Gateway <14.1-73.32
• Citrix Systems · NetScaler · Gateway <13.1-63.21
• Citrix Systems · NetScaler · ADC <14.1-73.32
• Citrix Systems · NetScaler · ADC <13.1-63.21
• NetScaler · ADC · 14.1 - 73.32, 13.1 - 63.21
• NetScaler · Gateway · 14.1 - 73.32, 13.1 - 63.21

Is there a patch?

• NetScaler Gateway 14.1-73.32
• NetScaler Gateway 13.1-63.21
• NetScaler ADC 14.1-73.32
• NetScaler ADC 13.1-63.21

What PlainSec published about CVE-2026-19490

• Citrix NetScaler Bypass Targets Trust Roles (2026-08-24)

Primary sources

• NVD record
• CISA KEV catalog

What this record does not say

• No CVSS score from NVD.
• No EPSS score.

KEV and EPSS are re-checked daily. Record last updated 2026-09-09.