CVE-2026-19490
Known exploited · CISA KEV
CISA federal remediation date Sep 12
Vulnerabilities · 48 days ago
Citrix published fixed builds for CVE-2026-19490 in NetScaler ADC and NetScaler Gateway, and CISA added the flaw to its Known Exploited Vulnerabilities catalog. CERT-SE says the issue can let an unauthenticated attacker run code remotely when the appliance is configured as a Gateway, including SSL VPN, ICA Proxy, CVPN, or RDP Proxy deployments.
The weakness sits in the internet-facing remote-access service itself, not behind an admin login. In plain terms, the front door that handles VPN and proxy traffic can be abused before authentication, which means a hit on the Gateway role can turn into code execution on the appliance even though the rest of the NetScaler estate may not share that exposure.
For operators, the important boundary is configuration: the urgent risk is concentrated in Gateway-mode installations, especially externally reachable SSL VPN and proxy endpoints. Once a gateway is fixed, the remaining question is whether any public-facing instances were running that role at all, because those are the systems that carried the exploitable path.
Known exploited · CISA KEV
CISA federal remediation date Sep 12
4 sources covering this story
Critical NetScaler Vulnerability Exploited in Attacks
Tracked as CVE-2026-19490, the authentication bypass flaw has been exploited in the wild since at least September 3.
Kritisk sårbarhet i Citrix NetScaler ADC och NetScaler Gateway - CERT-SE
Citrix har publicerat information om en kritisk sårbarhet som påverkar Citrix NetScaler ADC och NetScaler Gateway.
AL26-019 - Vulnerabilities impacting Citrix NetScaler ADC and NetScaler Gateway - CVE-2026-19490 and CVE-2026-19489 - Update 1
Critical Citrix NetScaler auth bypass now leveraged in attacks
Attackers have begun targeting a critical-severity Citrix NetScaler auth bypass flaw (CVE-2026-19490) in the wild, according to vulnerability intelligence company Previdian.
Part of the PlainSec briefing for 2026-09-07