Loading story…
Authorities warned that critical vulnerabilities in Veeam ONE and Citrix NetScaler Gateway/ADC could let attackers execute arbitrary commands, bypass security controls, and gain elevated privileges on exposed systems. The flaws were described as severe because successful exploitation could allow an intruder to operate on a target like a legitimate user and, in some cases, download and run additional programs over the network.
The alerts said exploitation could also expose confidential information and, in the Citrix case, enable unauthorized modification of data such as web content. Security bypass was highlighted as a path to reaching otherwise protected internal networks, while privilege escalation could hand attackers administrator-level access, increasing the risk of broader compromise and data theft.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Critical vulnerabilities in Veeam ONE were publicly reported. The flaws were described as potentially allowing arbitrary command execution, security bypass, privilege escalation, and unauthorized access to confidential information.
A critical vulnerability affecting Citrix NetScaler Gateway and ADC software was publicly reported. The issue was described as enabling severe impacts including arbitrary command execution, security bypass, privilege escalation, unauthorized data modification, and disclosure of confidential information.
A critical vulnerability affecting Citrix Gateway and Citrix ADC products was publicly reported. The issue was described as enabling arbitrary command execution, security bypass, privilege escalation, unauthorized data modification, and disclosure of confidential information.
A critical vulnerability in Adobe Acrobat and Reader was publicly reported. The flaw was described as enabling arbitrary command execution, potentially allowing an attacker to use the affected system with the privileges of the current user and run additional programs.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
10 references tracked. Mallory keeps watching after this page renders.
kyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple severe vulnerabilities in **Citrix ADC** and **NetScaler Gateway** exposed organizations to unauthenticated compromise, including remote code execution in `CVE-2019-19781` and `CVE-2023-3519`, as well as memory disclosure in `CVE-2023-4966` (**CitrixBleed**) and the later `CVE-2025-5777` variant. Public reporting showed that `CVE-2019-19781` could be exploited through crafted HTTP requests that abused directory traversal and template parsing to execute commands on vulnerable appliances, while research on `CVE-2023-3519` examined another critical path to code execution on internet-facing Citrix infrastructure.
Jun 29, 2026
Citrix released security updates for **NetScaler ADC** and **NetScaler Gateway** to fix two critical vulnerabilities, **`CVE-2026-19490`** and **`CVE-2026-19489`**, affecting internet-facing application delivery and remote access infrastructure. `CVE-2026-19490` is an authentication bypass flaw with a **CVSS v4.0 score of 9.3** that can be exploited remotely by an unauthenticated attacker with low complexity and no user interaction, while `CVE-2026-19489` is a memory overflow issue that can lead to service disruption and other unpredictable behavior. Vendor guidance ties both issues to Citrix bulletin **`CTX696939`**. Affected versions include NetScaler ADC and Gateway **14.1 before 14.1-73.32** and **13.1 before 13.1-63.21**, with additional impact noted for **NetScaler ADC FIPS before 14.1-73.32 FIPS** and **13.1-37.277 FIPS/NDcPP**. Finnish authorities and Rapid7 said they were not aware of active exploitation at publication time, but both urged organizations to patch immediately because exposed Citrix edge devices are frequent high-value targets. Citrix also published version-specific remediation guidance and configuration checks to help customers determine whether their deployments meet the prerequisites for exploitation.
Aug 22, 2026
Citrix NetScaler ADC and NetScaler Gateway appliances are affected by multiple critical vulnerabilities that can expose organizations to compromise, including `CVE-2025-5349`, `CVE-2025-5777`, and `CVE-2026-3055`. The flaws impact supported NetScaler releases, while end-of-life versions `12.1` and `13.0` remain vulnerable without fixes. `CVE-2025-5349` enables access-control bypass on the management interface, `CVE-2025-5777` is an out-of-bounds read that can leak sensitive memory contents, and `CVE-2026-3055` is an input-validation flaw that can lead to memory overwrite when NetScaler is configured as a SAML Identity Provider.
Jun 29, 2026