Loading story…
Citrix released permanent patches for the critical CVE-2019-19781 vulnerability affecting Citrix Application Delivery Controller (ADC), formerly NetScaler ADC, and Citrix Gateway appliances. Initial fixes for versions 11.1 and 12.0 were issued on 19 January 2020, followed by final patches for versions 10.5, 12.1, and 13.0 on 23–24 January. Successful exploitation could give an unauthenticated attacker full control of an affected Citrix server and potentially provide access to connected networks.
The Dutch National Cyber Security Centre urged organizations to patch according to their risk assessments, continuously monitor for exploitation, and review logs dating to 17 December 2019. Organizations that had not applied mitigations before 9 January were advised to presume compromise. Where patching was not immediately possible, the NCSC recommended restricting access through IP allowlisting, deploying a web application firewall, requiring client certificates, or taking exposed systems offline; changing an external service port was characterized only as a discovery deterrent, not an effective fix.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
Citrix made patches available for affected NetScaler ADC and Gateway Server versions 11.1 and 12.0.
The NCSC updated its guidance for organizations unable to upgrade internet-accessible Citrix servers, recommending measures including IP allowlisting, web application firewalls, client-certificate authentication, and changing exposed service ports.
The Dutch National Cyber Security Centre published its initial notice advising organizations on protective measures for affected Citrix systems.
Citrix released patches for affected versions 10.5, 12.1, and 13.0 over 23–24 January, completing availability of fixes cited by the NCSC.
Citrix published information about the Citrix ADC and Gateway Server vulnerability, initiating the period of log review later recommended by the Dutch NCSC.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
ncsc.nl
Open sourcencsc.nl
Open sourcecitrix.com
Open sourcecitrix.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Dutch National Cyber Security Centre (NCSC) warned that attackers were actively scanning for Citrix ADC and Citrix Gateway—formerly NetScaler—systems vulnerable to **CVE-2019-19781**. The flaw could allow an unauthenticated remote attacker to execute code and gain direct access to internal networks and systems; no vendor patch was available when the warning was issued, making Citrix-provided mitigations the immediate defensive measure. Organizations were urged to identify internet-exposed Citrix appliances, deploy and validate the mitigations, assess their status with Citrix’s available checking tool, and install the vendor update as soon as released. The NCSC cautioned that compromise could have occurred before mitigations were applied or where they failed, recommending specialist incident-response review for affected systems; XML files created and invoked under `vpns/portal/` could indicate attempted code execution, although their absence did not exclude intrusion.
Aug 31, 2026
Citrix and FireEye Mandiant released a forensic tool to help organizations investigate exploitation of **CVE-2019-19781**, a critical vulnerability affecting Citrix ADC and Citrix Gateway appliances. The Dutch National Cyber Security Centre warned that internet-facing affected systems not mitigated before public exploits emerged on 9 January 2020 should be presumed compromised. Organizations were advised to patch affected appliances immediately, review logs back to Citrix’s 17 December 2019 disclosure, and use forensic investigation to identify compromise. Where indicators are found, responders should rebuild affected systems from clean images and rotate credentials and certificates; organizations that applied mitigations earlier should still patch and monitor for activity by advanced threat actors.
Aug 31, 2026
Citrix released security updates for **NetScaler ADC** and **NetScaler Gateway** to fix two critical vulnerabilities, **`CVE-2026-19490`** and **`CVE-2026-19489`**, affecting internet-facing application delivery and remote access infrastructure. `CVE-2026-19490` is an authentication bypass flaw with a **CVSS v4.0 score of 9.3** that can be exploited remotely by an unauthenticated attacker with low complexity and no user interaction, while `CVE-2026-19489` is a memory overflow issue that can lead to service disruption and other unpredictable behavior. Vendor guidance ties both issues to Citrix bulletin **`CTX696939`**. Affected versions include NetScaler ADC and Gateway **14.1 before 14.1-73.32** and **13.1 before 13.1-63.21**, with additional impact noted for **NetScaler ADC FIPS before 14.1-73.32 FIPS** and **13.1-37.277 FIPS/NDcPP**. Finnish authorities and Rapid7 said they were not aware of active exploitation at publication time, but both urged organizations to patch immediately because exposed Citrix edge devices are frequent high-value targets. Citrix also published version-specific remediation guidance and configuration checks to help customers determine whether their deployments meet the prerequisites for exploitation.
Aug 22, 2026