60
60
60
60
60
60
60
60
60
Exploits in the Wild for Citrix ADC and Citrix Gateway Directory Traversal Vulnerability CVE-2019
Unit 42 confirmed in-the-wild exploitation of CVE-2019-19781, a critical Citrix ADC/Gateway directory traversal flaw enabling unauthenticated file access and RCE.
CVE-2019-19781, a CVSS 9.8 directory traversal vulnerability, affects all supported versions of Citrix ADC and Citrix Gateway. Unit 42 captured multiple exploitation attempts in the wild and identified scanning activity from roughly 700 Shodan-exposed hosts. The flaw stems from improper pathname handling in Apache, allowing unauthenticated attackers to read sensitive files like smb.conf or achieve remote code execution via crafted XML. Palo Alto Networks released Threat Prevention signatures 57497 and 57570 on January 7, 2020, while Citrix published advisories CTX267027 and CTX267679 with responder policy mitigations pending a late-January patch.
82
60
60
60
60
60
60
60
60
CISA Adds Citrix NetScaler CVE-2025-5777 to KEV Catalog as Active Exploits Target Enterprises
60
Citrix NetScaler zero-day exploited in the wild, patch is available (CVE-2023-3519)
60
60
60
It’s a hot 0-day summer for Apple, Google, and Microsoft security fixes
60
Citrix, VMware, and Atlassian Hit with Critical Flaws — Patch ASAP!
60
60
60
Citrix Patches Six NetScaler Flaws Allowing File Read and Denial-of
60
CitrixBleed 2 Vulnerability Exploited
60
Week in review: VirusTotal data leak, Citrix NetScaler zero-day exploitation
60
60
60
60
60
Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490)
Citrix patched a critical authentication bypass, CVE-2026-19490, in NetScaler Gateway and NetScaler ADC, urging customers to upgrade immediately.
Citrix has patched two flaws in NetScaler ADC and NetScaler Gateway. CVE-2026-19490 is a critical authentication bypass (CVSS v4.0 9.3) that works when the appliance is configured as an SSL VPN, ICA Proxy, CVPN, RDP Proxy Gateway or AAA virtual server, with additional conditions depending on firmware and SAML configuration. A second flaw, CVE-2026-19489 (CVSS 8.8), is a memory overflow that can cause denial of service when SIP ALG is enabled on LSN setups. Rapid7 had not observed exploitation as of August 19, 2026, but urged emergency patching; a signature-based mitigation is available via NetScaler Console.
78
60
60
60
60
60
60