Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-19490 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2026 |
| Date Published | 2026-09-09 |
| Vendor | Citrix |
| Product | NetScaler |
| CVSS Score | 9.8 (critical) |
| EPSS Score | 5.6% (percentile: 93%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-09-12 |
Vulnerability Description
Source: CISA KEV
Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel.
The flaw surfaces under specific configurations — when the appliance acts as an AAA virtual server or as a Gateway in one of these modes: SSL VPN, ICA Proxy, CVPN or RDP Proxy. In such a configuration, an unauthenticated remote threat actor may be able to bypass authentication.
That qualifier matters when scoping remediation: not every NetScaler deployment is exposed in the same way — the configured role decides. It is worth noting, however, that the listed modes are precisely those in which NetScaler serves as a remote-access gateway, and is therefore exposed to external traffic by design.
The entry appears in the CISA KEV catalog as actively exploited, and the assigned remediation deadline of 2026-09-12 has passed.
Required Actions
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 (“Prioritizing Security Updates Based on Risk”) guidance and CISA’s “Forensics Triage Requirements”. For cloud services, follow the applicable BOD 26-04 guidance; if mitigations are unavailable, discontinue use of the product.
Evaluating each asset’s internet exposure and adhering to BOD 26-04 patching guidelines remain the organisation’s responsibility.
Who Is Affected?
This vulnerability affects organisations running Citrix NetScaler ADC and NetScaler Gateway.
Start from a configuration inventory rather than a version check: identify which of your appliances act as an AAA virtual server or as a Gateway in SSL VPN, ICA Proxy, CVPN or RDP Proxy mode. Those define the real exposure. Because the appliance handles remote access in those roles, it is in practice reachable from the internet.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
