{"id":"CVE-2026-19490","aliases":["EUVD-2026-62395","GHSA-7c6h-rhhv-wm8r"],"status":"published","title":"NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490","description":"Vulnerability in NetScaler ADC and NetScaler Gateway.\n\nThis issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.33262,"percentile":0.98391,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-288"],"published":"2026-08-19T12:54:39Z","modified":"2026-10-26T13:10:00Z","kev":{"date_added":"2026-09-09","due_date":"2026-09-12","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2026-09-09"},{"source":"kev","since":"2026-09-09"}],"exploits":[{"source":"pocgithub","id":"TarPeg007/CVE-2026-19490","title":"TarPeg007/CVE-2026-19490","date":"2026-09-02","url":"https://github.com/TarPeg007/CVE-2026-19490"},{"source":"pocgithub","id":"BishopFox/CVE-2026-19490-check","title":"BishopFox/CVE-2026-19490-check","date":"2026-09-10","url":"https://github.com/BishopFox/CVE-2026-19490-check"},{"source":"pocgithub","id":"CompleteTech-Security/netscaler-cve-2026-19490-check","title":"CompleteTech-Security/netscaler-cve-2026-19490-check","date":"2026-10-23","url":"https://github.com/CompleteTech-Security/netscaler-cve-2026-19490-check"}],"products":[{"vendor":"citrix","product":"netscaler"},{"vendor":"citrix","product":"netscaler_application_delivery_controller"},{"vendor":"citrix","product":"netscaler_gateway"},{"vendor":"netscaler","product":"adc"},{"vendor":"netscaler","product":"gateway"}],"references":[{"url":"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19490","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19490"},{"url":"https://github.com/advisories/GHSA-7c6h-rhhv-wm8r"}],"sources":{"cve":[{"id":"CVE-2026-19490","title":"NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490","description":"Vulnerability in NetScaler ADC and NetScaler Gateway.\n\nThis issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.","status":"published","published":"2026-08-19T12:54:39.73Z","modified":"2026-10-07T18:01:17.32Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"critical","assessor":"cna"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T13:47:17.512524Z"}],"euvd":[{"id":"EUVD-2026-62395","description":"Vulnerability in NetScaler ADC and NetScaler Gateway.\n\nThis issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.","status":"published","published":"2026-08-19T12:54:39Z","modified":"2026-10-07T18:01:17Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L","level":"critical"}],"exploited_since":"2026-09-09","updated_at":"2026-11-02T17:27:34.353796Z"}],"ghsa":[{"id":"GHSA-7c6h-rhhv-wm8r","title":"Vulnerability in NetScaler ADC and NetScaler Gateway.\n\nThis issue affects ADC: from 14.1 through...","description":"Vulnerability in NetScaler ADC and NetScaler Gateway.\n\nThis issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.","status":"published","published":"2026-08-19T15:32:21Z","modified":"2026-09-10T15:33:58Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:11:42.086801Z"}],"kev":[{"id":"CVE-2026-19490","title":"Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability","description":"Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.","cwes":["CWE-288"],"kev":{"date_added":"2026-09-09","due_date":"2026-09-12","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2026-19490","description":"Vulnerability in NetScaler ADC and NetScaler Gateway.\n\nThis issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.","status":"published","published":"2026-08-19T13:17:45Z","modified":"2026-10-26T13:10:00.14Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:12:39.620837Z"}]}}