Summary
generated automatically from NVD dataCVE-2026-19490 affects Citrix NetScaler ADC and NetScaler Gateway, in the 14.1 and 13.1 branches up to builds 73.32 and 63.21 respectively. The weakness is classified as CWE-288, an authentication bypass using an alternate path or channel. It is rated CRITICAL with a CVSS v3.1 score of 9.8, and the vector indicates it can be exploited over the network without privileges or user interaction, with high impact on confidentiality, integrity and availability. CISA lists it in its KEV catalog, so it is actively exploited.
NVD description
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-09. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2026-09-12
EPSS · FIRST.org
23.2%probability of exploitation in the next 30 days
Higher than 97% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 19 août 2026
- Updated
- 7 oct. 2026
- Status
- Analyzed
- Source
- 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5
Affected products
Weaknesses (CWE)
References (2)
Similar CVEs
Other vulnerabilities of type CWE-288
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.