NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490

What is affected, what to do

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.

The vulnerability is being actively exploited; treat it as a priority. Update netscaler_application_delivery_controller to version 13.1-63.21, netscaler_gateway to version 13.1-63.21, NetScaler ADC to version 14.1-73.32. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• NetScaler ADC lte 14.1..73.32
• NetScaler ADC lte 13.1..63.21
• NetScaler Gateway lte 14.1..73.32
• NetScaler Gateway lte 13.1..63.21

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Establish exposure: Inventory every NetScaler ADC and NetScaler Gateway instance (MPX, VPX, SDX instances). Check whether each one is configured as an AAA virtual server or Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) using show running config | grep -i "add authentication vserver\|add vpn vserver". Per CISA, only these roles are exploitable. Internet-facing gateways come first.
   • Patch: The context lists 14.1-73.32 and 13.1-37.277 as patched reference builds. However, the affected-range data is contradictory: 14.1 through 73.32 and 13.1 through 63.21 are also listed as affected. Confirm the actual fixed build in the Citrix Security Bulletin and deploy the newest available build for your release train. Migrate or decommission any end-of-life release lines.
   • Kill sessions after patching: Hijacked sessions survive the upgrade. Update both HA nodes, then run kill aaa session -all, kill icaconnection -all, kill rdp connection -all, kill pcoipConnection -all and clear lb persistentSessions.
   • Preserve evidence before upgrading: Copy off /var/log/ns.log*, /var/log/httpaccess.log*, /var/log/bash.log* and ns.conf. Check for newly created PHP, XML or shell files in /var/netscaler/logon/, /var/vpn/, /netscaler/ns_gui/ and /var/tmp/, which may indicate webshells. If you find any, take a forensic image rather than just patching over it.
   • Rotate credentials: If you see signs of exploitation, rotate the nsroot password, any LDAP/RADIUS bind accounts stored on the appliance, and the SSL private keys. Also reset credentials and tokens for users whose sessions were active during the suspect window.
   • Check reporting duties: If remote-access compromise is confirmed, the NIS2 24-hour early-warning deadline to your national CSIRT/authority applies.
2. 02

   Runbook step 2

   Mitigation layers

   • Configuration: Disable gateway features you do not use (CVPN, RDP Proxy, ICA Proxy). Remove dormant AAA vServers or switch them off with disable vpn vserver / disable authentication vserver. Every feature turned off removes attack surface.
   • Network segmentation: Restrict the management interface (NSIP) and any management-enabled SNIPs to a dedicated admin VLAN. Egress-filter the appliance to backend targets, auth servers, NTP and DNS only. This blocks reverse shells and tool downloads.
   • Perimeter access restriction: Where the business allows, limit gateway vServers to known source ranges or geographies, using an upstream firewall or a NetScaler responder policy. If Citrix publishes a specific responder/rewrite mitigation, apply it as a stopgap. The exploit paths are not specified in the context, so do not hand-roll signatures. Enable vendor IPS/Suricata ET signatures as soon as they ship.
   • IAM / least privilege: Scope VPN user groups tightly with per-group authorization policies instead of broad network access. Put independent MFA on critical backend applications so that a bypassed gateway login does not translate directly into domain access.
   • Monitoring window: Until patched, raise audit verbosity (set audit syslogParams -logLevel ALL) and forward logs off-box to the SIEM. Local logs rotate quickly and are a common target for attacker cleanup.
3. 03

   Runbook step 3

   Detection rules

   • Sessions without authentication (ns.log / syslog): Hunt for SSLVPN/AAA session events that have no preceding successful LOGIN from the same user and source IP. Sessions with empty or odd usernames are equally suspect. Sigma shape: logsource: netscaler · selection: event_type in (SSLVPN, AAA) · filter: preceding LOGIN within 5m.
   • Anomalous session patterns: Watch for one session ID or user appearing from multiple source IPs or ASNs at once, and for logins from hosting/VPS ranges. SPL: index=netscaler sourcetype=citrix:netscaler:syslog | stats dc(src_ip) as ips by user | where ips>2.
   • Webshells and process ancestry: Flag httpd or nsppe spawning sh, bash, php, python, curl, wget or nc, using bash.log or EDR where deployed. Also flag new files under /var/netscaler/logon/ or /netscaler/ns_gui/vpn/. For a quick baseline, run find / -newer /flash/nsconfig/ns.conf -type f.
   • Web access (httpaccess.log): Review HTTP 200 responses on unusual paths outside the normal logon flow, POSTs with abnormal header lengths, and requests to recently created .php/.xml files.
   • Network telemetry (Zeek/Suricata): Alert on new outbound connections from the NSIP/SNIP to internet destinations (conn.log where id.orig_h is the appliance and the destination is unknown). Also alert on lateral movement from the VPN address pool to domain controllers (LDAP, SMB, Kerberos) by users who do not normally touch them.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.

Source: NVD (NIST), cvelistv5, CISA KEV Catalog, ASD ACSC (CC BY 4.0), CSA/SingCERT, pwn.watch, certeu_advisory, BSI WID Portal, BSI CSAF

Vendors and products

• Citrix Citrix NetScaler Application Delivery Controller (ADC)
• Citrix Citrix NetScaler Gateway
• Citrix Systems Netscaler Adc
• Citrix Systems Netscaler Gateway
• NetScaler NetScaler ADC
• NetScaler NetScaler Gateway

Weakness classes (CWE)

• CWE-288Authentication Bypass Using an Alternate Path or Channel

  Base

  The product requires authentication, but the product has an alternate path or channel that does not require authentication.

  Entry at MITRE CWE-288

References & sources

• support.citrix.comsupport-home/kbsearch/article?articleNumber=CTX696939Vendor advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19490government-resource, US government resource
• pwn.watchpwn.watch: Citrix NetScaler: Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerabilitypwn-watch
• support.citrix.comCitrix NetScaler — CVE-2026-19490pwn-watch
• NVD (NIST)NVD: CVE-2026-19490pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 07.10.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	removed	{"id":"CVE-2026-19490","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-19T00:00:00+00:00"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-19490","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-10T03:55:17.447903Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

2. 10.09.2026Initial analysis by NVDNVD

   Newly listed as affected:

   • Citrix NetScaler Application Delivery Controller (ADC) (13.1 – before 13.1-63.21; 14.1 – before 14.1-73.32; 14.1-66.68 – through 14.1-73.32; 13.1 – before 13.1-37.277)
   • Citrix NetScaler Gateway (13.1 – before 13.1-63.21; 14.1 – before 14.1-73.32)

   CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19490
   • https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939
   Show 4 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   CVSS	added	—	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
   Product configuration	added	—	OR *cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* versions from (including) 13.1 up to (excluding) 13.1-63.21 *cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:* versions from (including) 14.1 up to (excluding) 14.1-73.32 *cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:* versions from (including) 14.1-66.68 up to (including) 14.1-73.32 *cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* versions from (including) 13.1 up to (excluding) 13.1-63.21 *cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:* versions from (including) 14.1 up to (excluding) 14.1-73.32 *cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:* versions from (including) 13.1 up to (excluding) 13.1-37.277 *cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:* versions from (including) 13.1 up to (excluding) 13.1-37.277
   Reference type	added	—	CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19490 Types: US Government Resource
   Reference type	added	—	NetScaler: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939 Types: Vendor Advisory

   Source identifier: nvd@nist.gov

3. 10.09.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2026-19490","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-09-09T19:50:05.742072Z"}	{"id":"CVE-2026-19490","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-19T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

4. 09.09.2026CISA KEV entry updated9119a7d8…

   4 individual changes: Date Added, Due Date, Required Action, Vulnerability Name

   Show 4 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Date Added	added	—	2026-09-09
   Due Date	added	—	2026-09-09
   Required Action	added	—	2026-09-09
   Vulnerability Name	added	—	2026-09-09

   Source identifier: 9119a7d8-5eab-497f-8521-727c672e3725

5. 20.08.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: none known, automatable: yes

   Weakness type: CWE-288

   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Weakness type (CWE)	added	—	CWE-288
   SSVC assessment	changed	{"id":"CVE-2026-19490","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-19T00:00:00+00:00"}	{"id":"CVE-2026-19490","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-08-20T03:56:10.740519Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

One NVD translation into another language is hidden.

Linked advisories

• Critical NetScaler Vulnerability Exploited in AttacksSecurityWeek10.09.2026
• NCSC-2026-0318 [1.01] [H/H] Kwetsbaarheden verholpen in Citrix NetScaler ADC en NetScaler GatewayNCSC-NL07.09.2026
• Critical Citrix NetScaler auth bypass now leveraged in attacksBleepingComputer04.09.2026
• Citrix issues critical security updates for its NetScaler devicesCSO Online20.08.2026
• NCSC-2026-0318 [1.00] [M/M] Kwetsbaarheden verholpen in Citrix NetScaler ADC en NetScaler GatewayNCSC-NL20.08.2026
• Updates: Oracle Critical Security Patch Update for August 2026; Citrix NetScaler Vulnerabilities; Atlassian and Splunk VulnerabilitiesSANS NewsBites19.08.2026
• Software Developer on Trial in Switzerland Facing Charges Related to Ransomware AttacksSANS NewsBites17.08.2026