Loading story…
Citrix disclosed CVE-2026-19490, a critical NetScaler ADC and NetScaler Gateway flaw with a CVSS v4 score of 9.3. In affected Gateway and AAA virtual-server configurations—including SSL VPN, ICA Proxy, CVPN, and RDP Proxy—an unauthenticated remote attacker can bypass authentication and may execute arbitrary code. A public proof of concept emerged, exploitation attempts were observed by sensors, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog.
Citrix also patched CVE-2026-19489, a high-severity memory-overflow denial-of-service vulnerability affecting appliances that have SIP ALG enabled on an LSN group. No workarounds are available for either issue; organizations running customer-managed NetScaler appliances should urgently apply Citrix updates and investigate internet-exposed or potentially affected systems for evidence of compromise.
See which actors are running it and whether you're in range.
9 events from the most recent confirmed update back to the earliest known activity.
CISA warned that threat actors were exploiting CVE-2026-19490 in attacks and directed U.S. federal agencies to remediate the vulnerability within three days under Binding Operational Directive 26-04. CISA did not disclose technical details of the observed exploitation.
Security researchers recorded 56 attempted exploits targeting honeypot systems for CVE-2026-19490 from September 3 through September 8. The reporting confirmed attempted exploitation but did not independently verify successful compromises of production systems.
Previdian observed exploitation attempts against CVE-2026-19490 within 24 hours of public proof-of-concept availability and through at least 6 September. It recorded 10 attempts from six unique IP addresses, but the telemetry did not confirm successful compromises.
The Australian Cyber Security Centre issued an alert urging Australian organizations to prioritize patching affected NetScaler appliances, noting that internet-facing appliances are frequent initial-access targets.
A public proof of concept for the critical NetScaler Gateway and AAA authentication-bypass vulnerability CVE-2026-19490 reportedly became available around 3 September 2026.
Citrix disclosed CVE-2026-19489, a high-severity memory-overflow denial-of-service flaw, and CVE-2026-19490, a critical unauthenticated authentication-bypass flaw, affecting NetScaler ADC and NetScaler Gateway. The company addressed both issues in bulletin CTX696939 and provided patched releases, stating that no workarounds were available.
Bishop Fox documented how attacker-controlled decoded RelayState lengths can trigger packet-engine crashes or create anonymous sessions on vulnerable NetScaler Gateway and AAA virtual servers. The report described configuration-dependent HTTP(S) proxying from anonymous Gateway sessions, a demonstrated credential-dependent route to root command execution via NITRO, and a safe single-request detection method.
Brazil's CTIR Gov issued a TLP:CLEAR alert on CVE-2026-19490, identifying affected NetScaler ADC and Gateway 13.1 and 14.1 release lines and urging immediate application of Citrix's fixes. The notice also stated that ReGIC member agencies must urgently remediate vulnerabilities identified in alerts and recommendations.
CISA added CVE-2026-19490 to its Known Exploited Vulnerabilities catalog, indicating that exploitation had been observed. CERT-SE urged organizations to apply Citrix's updates and investigate potentially affected systems for evidence of intrusion.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
10 references tracked. Mallory keeps watching after this page renders.
gov.br
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcebishopfox.com
Open sourcecert.se
Open sourcetriskelelabs.com
Open sourcecirt.gy
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers have begun attempting to exploit **CVE-2026-19490**, a critical authentication-bypass vulnerability in Citrix NetScaler ADC and NetScaler Gateway. Remote, unauthenticated actors can bypass authentication on susceptible appliances configured as AAA virtual servers or Gateway services when affected firmware versions and SAML Action settings are present; sensor data from Previdian confirms exploitation attempts, though not confirmed successful compromises. Citrix issued fixes on August 19 and urged customers to upgrade affected appliances. Australia’s ACSC and Belgium’s national cybersecurity coordination center have also called for urgent patching, warning that internet-facing edge devices are frequent initial-access targets. Organizations should identify exposed NetScaler instances and vulnerable SAML/VPN configurations, apply the relevant updates, and continue monitoring appliances after remediation. Citrix also disclosed **CVE-2026-19489**, a memory-overflow flaw affecting deployments using SIP ALG with Large Scale NAT groups.
Sep 4, 2026
Citrix released security updates for **NetScaler ADC** and **NetScaler Gateway** to fix two critical vulnerabilities, **`CVE-2026-19490`** and **`CVE-2026-19489`**, affecting internet-facing application delivery and remote access infrastructure. `CVE-2026-19490` is an authentication bypass flaw with a **CVSS v4.0 score of 9.3** that can be exploited remotely by an unauthenticated attacker with low complexity and no user interaction, while `CVE-2026-19489` is a memory overflow issue that can lead to service disruption and other unpredictable behavior. Vendor guidance ties both issues to Citrix bulletin **`CTX696939`**. Affected versions include NetScaler ADC and Gateway **14.1 before 14.1-73.32** and **13.1 before 13.1-63.21**, with additional impact noted for **NetScaler ADC FIPS before 14.1-73.32 FIPS** and **13.1-37.277 FIPS/NDcPP**. Finnish authorities and Rapid7 said they were not aware of active exploitation at publication time, but both urged organizations to patch immediately because exposed Citrix edge devices are frequent high-value targets. Citrix also published version-specific remediation guidance and configuration checks to help customers determine whether their deployments meet the prerequisites for exploitation.
Aug 22, 2026
Citrix disclosed **CVE-2025-6543**, a critical memory overflow vulnerability in **NetScaler ADC** and **NetScaler Gateway** that affects devices configured as a **Gateway** or **AAA virtual server**. The flaw can trigger unintended control-flow redirection and service disruption, leading to **denial of service**, and was assigned a **CVSS v4.0 score of 9.2**. Affected releases include NetScaler ADC and Gateway `14.1` before `14.1-47.46`, `13.1` before `13.1-59.19`, and NetScaler ADC `13.1-FIPS/NDcPP` before `13.1-37.236-FIPS/NDcPP`; Citrix also said **Secure Private Access** on-prem and hybrid deployments using NetScaler instances are impacted. Citrix directed customers to upgrade immediately to fixed builds or discontinue use where no supported update is available, with the issue tracked in Citrix advisory **CTX694826** and the CVE record **CVE-2025-6543**. Follow-on guidance warned that upgrading to `14.1-47.46` or `13.1-59.19` may introduce authentication problems, including broken login pages in environments using **DUO** or **SAML**, and the company published remediation steps for affected deployments.
Jul 24, 2026