Critical NetScaler Vulnerability Exploited in Attacks
CISA added critical Citrix NetScaler flaw CVE-2026-19490 (CVSS 9.3) to its KEV catalog after confirming exploitation of gateway and AAA virtual servers in the wild.
CISA warned that threat actors are exploiting CVE-2026-19490, a critical-severity flaw (CVSS 9.3) affecting NetScaler ADC and NetScaler Gateway appliances configured as a gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Citrix patched the bug on August 19, and Rapid7 warned it is remotely exploitable without authentication. Sensor data from Previdian shows exploitation ongoing since at least September 3, one day after a public exploit appeared on GitHub, with matching requests observed from three IPs across three countries. CISA added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies three days to patch under BOD 26-04.
- CISA added CVE-2026-19490 to the KEV catalog, requiring federal agencies to patch within three days.
- Flaw affects NetScaler ADC and Gateway appliances configured as SSL VPN, ICA Proxy, CVPN, RDP Proxy, or AAA virtual servers.
- Citrix patched the 9.3-severity bug on August 19; Rapid7 said it is remotely exploitable without authentication.
- Sensor telemetry shows exploitation since at least September 3, following a public exploit on GitHub.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-19490 | Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability (CWE-288, 'using an alternate path or channel') that an unauthenticated remote threat actor can exploit. The flaw is triggerable when the appliance is configured as an AAA virtual server or as a Gateway, including SSL VPN, ICA Proxy, CVPN, or RDP Proxy deployments, allowing the attacker to bypass authentication without valid credentials. A successful bypass could give an attacker access to VPN-protected or AAA-gated resources as an authenticated user; no CVSS score has been published yet. Organizations running affected NetScaler appliances in these configurations are exposed, and affected version ranges are not specified in the available data, so defenders should consult Citrix advisory AL26-019. The flaw was added to CISA's KEV on 2026-09-09, indicating exploitation in the wild; ransomware use is unknown, no public PoC is known, and EPSS assigns a 3.4% probability of exploitation within 30 days (88th percentile). Do: Prioritize applying vendor fixes or mitigations per Citrix advisory AL26-019 in line with CISA BOD 26-04, focusing first on internet-facing appliances configured as AAA virtual servers or Gateways (SSL VPN, ICA Proxy, CVPN, RDP Proxy). Until patched, restrict internet exposure and review VPN/AAA authentication logs for signs of unauthenticated access, following CISA's Forensics Triage Requirements if compromise is suspected. | 9.3 | 6% | KEV PoC |
| largeon the order of 10,000-100,000 internet-exposed NetScaler ADC/Gateway appliances |
Full article281 words · extracted from securityweek.com · click to collapse
The US Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday warned that threat actors have been exploiting a critical-severity NetScaler vulnerability in attacks.
Tracked as CVE-2026-19490 (CVSS score of 9.3), the security defect impacts all NetScaler ADC and NetScaler Gateway appliances configured as a gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server.
Citrix patched the flaw on August 19, when cybersecurity firm Rapid7 warned that it could be exploited remotely without authentication.
Rapid7 also said it was expecting threat actors to start exploiting the bug shortly, given the nature of NetScaler deployments within enterprise environments.
“Organizations should prioritize patching affected systems on an emergency basis, since Citrix products are high-value targets that tend to quickly see exploitation in the wild,” the company said.
On Wednesday, CISA added CVE-2026-19490 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within three days, in line with BOD 26-04’s requirements.
Advertisement. Scroll to continue reading.
While the cybersecurity agency has not provided details on the observed exploitation attempts, its alert comes roughly a week after Previdian founder and former WatchTowr head of threat intelligence Ryan Dewhurst warned that hackers started exploiting the vulnerability.
“An unverified but credible PoC appeared yesterday. Today, 3 IPs across 3 countries sent matching requests to our sensor,” Dewhurst said.
CVE-2026-19490’s exploitation has been ongoing since at least September 3, one day after an exploit targeting it was published on GitHub, data from Previdian shows.
Related: Organizations Warned of Cisco Secure FMC Exploitation
Related: New ‘ShieldCrash’ Zero-Day Exploit Targets Microsoft Defender
Related: Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.securityweek.com/critical-netscaler-vulnerability-exploited-in-attacks/