Loading story…
Attackers have begun attempting to exploit CVE-2026-19490, a critical authentication-bypass vulnerability in Citrix NetScaler ADC and NetScaler Gateway. Remote, unauthenticated actors can bypass authentication on susceptible appliances configured as AAA virtual servers or Gateway services when affected firmware versions and SAML Action settings are present; sensor data from Previdian confirms exploitation attempts, though not confirmed successful compromises.
Citrix issued fixes on August 19 and urged customers to upgrade affected appliances. Australia’s ACSC and Belgium’s national cybersecurity coordination center have also called for urgent patching, warning that internet-facing edge devices are frequent initial-access targets. Organizations should identify exposed NetScaler instances and vulnerable SAML/VPN configurations, apply the relevant updates, and continue monitoring appliances after remediation. Citrix also disclosed CVE-2026-19489, a memory-overflow flaw affecting deployments using SIP ALG with Large Scale NAT groups.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued Alert AL26-019 covering CVE-2026-19490 and CVE-2026-19489 in Citrix NetScaler ADC and Gateway. It urged organizations to identify vulnerable SAML, Gateway, and AAA configurations, urgently upgrade to fixed releases, and monitor logs and network activity for unauthorized access.
A Previdian NetScaler sensor received requests matching the CVE-2026-19490 proof-of-concept from three source IP addresses geolocated to Australia, the United States, and Germany. Previdian characterized the activity as exploitation attempts, not evidence of successful intrusions.
Citrix issued an advisory and released fixes for CVE-2026-19489, a memory-overflow flaw, and CVE-2026-19490, an authentication-bypass flaw affecting certain NetScaler ADC and Gateway configurations.
Belgium's Centre for Cybersecurity and National Cybersecurity Coordination Centre warned organizations about exploitation attempts against CVE-2026-19490 and urged administrators to prioritize patching vulnerable NetScaler appliances.
Australia's ACSC urged organizations to identify affected NetScaler configurations, apply Citrix's updates, and monitor patched environments for suspicious activity. It said it had no information that a particular Australian sector was being targeted.
After a credible proof-of-concept for CVE-2026-19490 was published online, attackers began attempting to target the NetScaler authentication-bypass vulnerability. The source does not confirm any successful compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcebleepingcomputer.com
Open sourcethecyberexpress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citrix disclosed **CVE-2026-19490**, a critical NetScaler ADC and NetScaler Gateway flaw with a CVSS v4 score of 9.3. In affected Gateway and AAA virtual-server configurations—including SSL VPN, ICA Proxy, CVPN, and RDP Proxy—an unauthenticated remote attacker can bypass authentication and may execute arbitrary code. A public proof of concept emerged, exploitation attempts were observed by sensors, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog. Citrix also patched **CVE-2026-19489**, a high-severity memory-overflow denial-of-service vulnerability affecting appliances that have SIP ALG enabled on an LSN group. No workarounds are available for either issue; organizations running customer-managed NetScaler appliances should urgently apply Citrix updates and investigate internet-exposed or potentially affected systems for evidence of compromise.
Sep 10, 2026
Citrix released fixes for six vulnerabilities in **NetScaler ADC** and **NetScaler Gateway**, including **CVE-2026-8451**, a high-severity out-of-bounds read flaw that can leak sensitive memory from appliances configured as a **SAML Identity Provider**. The bug affects customer-managed NetScaler ADC, Gateway, and related **FIPS/NDcPP** variants, and can expose memory contents in the `NSC_TASS` cookie via malformed requests to the `/saml/login` endpoint. Other patched issues include **CVE-2026-8452**, **CVE-2026-8655**, **CVE-2026-10816**, **CVE-2026-10817**, and **CVE-2026-13474**, covering risks such as arbitrary file reads, memory corruption, and denial of service, including a new **HTTP/2 Bomb** attack. Security researchers and defenders reported that **CVE-2026-8451** was exploited in the wild less than 24 hours after public disclosure, with Lupovis observing threat actors scanning exposed NetScaler systems and sending exploit payloads immediately after receiving valid `200 OK` responses. The observed activity matched public technical details released by watchTowr, using malformed SAML `AuthnRequest` data padded to trigger the overread condition. Government and industry advisories urged organizations to patch immediately, disable **SAML IdP** where patching is not possible, review `/saml/login` traffic and `NSC_TASS` cookie values for signs of compromise, restrict management exposure, and follow Citrix incident guidance if exploitation is suspected.
Jul 9, 2026
Citrix released security updates for **NetScaler ADC** and **NetScaler Gateway** to fix two critical vulnerabilities, **`CVE-2026-19490`** and **`CVE-2026-19489`**, affecting internet-facing application delivery and remote access infrastructure. `CVE-2026-19490` is an authentication bypass flaw with a **CVSS v4.0 score of 9.3** that can be exploited remotely by an unauthenticated attacker with low complexity and no user interaction, while `CVE-2026-19489` is a memory overflow issue that can lead to service disruption and other unpredictable behavior. Vendor guidance ties both issues to Citrix bulletin **`CTX696939`**. Affected versions include NetScaler ADC and Gateway **14.1 before 14.1-73.32** and **13.1 before 13.1-63.21**, with additional impact noted for **NetScaler ADC FIPS before 14.1-73.32 FIPS** and **13.1-37.277 FIPS/NDcPP**. Finnish authorities and Rapid7 said they were not aware of active exploitation at publication time, but both urged organizations to patch immediately because exposed Citrix edge devices are frequent high-value targets. Citrix also published version-specific remediation guidance and configuration checks to help customers determine whether their deployments meet the prerequisites for exploitation.
Aug 22, 2026