Actively exploited in the wild
Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability
Citrix - NetScaler · Listed in the CISA KEV since 2026-09-09. This indicates confirmed attacks in production environments.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-19490
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk93th percentile - higher than 93% of all known CVEs
Summary
Vulnerability in NetScaler ADC and NetScaler Gateway products. Affects ADC versions from 14.1 through 73.32 and from 13.1 through 63.21; Gateway versions from 14.1 through 73.32 and from 13.1 through 63.21.
Risk Assessment
Risk includes potential unauthorized access, data integrity compromise, or service disruption. The vulnerability may be exploited remotely.
Recommendation
Check for available security updates from the vendor and apply them immediately. Also monitor vendor advisories.
Other vulnerabilities in NetScaler ADC and NetScaler Gateway
See all- CVE-2026-8452CriticalActively exploited
A memory overflow vulnerability in NetScaler ADC and NetScaler Gateway can lead to unpredictable or erroneous behavior and Denial of Service (DoS) if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.
- CVE-2023-6548MediumActively exploited
A code injection vulnerability in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP, or SNIP management interface to perform authenticated (low privileged) remote code execution on the Management Interface.
- CVE-2026-19489High
Vulnerability in NetScaler ADC and NetScaler Gateway. Affects ADC versions from 14.1 through 73.32 and from 13.1 through 63.21; Gateway from 14.1 through 73.32 and from 13.1 through 63.21.
- CVE-2026-10817High
Insufficient input validation in NetScaler ADC and NetScaler Gateway leads to memory overread if the TCP Timestamp is enabled in the TCP Profile and associated with a virtual server (type LB, CS, VPN) or a configured service.
- CVE-2026-10816High
An unauthenticated attacker can read arbitrary files on NetScaler ADC and NetScaler Gateway if access to NSIP, Cluster Management IP, or SNIP with management access is enabled.
Original NVD description (English source)
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS