Loading story…
CVE-2025-7775, a memory overflow vulnerability in Citrix NetScaler ADC and Gateway, is being actively exploited for remote code execution and denial of service. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, and additional related flaws (CVE-2025-7776, CVE-2025-8424) have also been disclosed. Organizations are urged to patch immediately and monitor for suspicious activity, as adversaries are leveraging AI-driven exploit frameworks to accelerate attacks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Citrix disclosed **CVE-2026-19490**, a critical NetScaler ADC and NetScaler Gateway flaw with a CVSS v4 score of 9.3. In affected Gateway and AAA virtual-server configurations—including SSL VPN, ICA Proxy, CVPN, and RDP Proxy—an unauthenticated remote attacker can bypass authentication and may execute arbitrary code. A public proof of concept emerged, exploitation attempts were observed by sensors, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog. Citrix also patched **CVE-2026-19489**, a high-severity memory-overflow denial-of-service vulnerability affecting appliances that have SIP ALG enabled on an LSN group. No workarounds are available for either issue; organizations running customer-managed NetScaler appliances should urgently apply Citrix updates and investigate internet-exposed or potentially affected systems for evidence of compromise.
Sep 10, 2026
Multiple severe vulnerabilities in **Citrix ADC** and **NetScaler Gateway** exposed organizations to unauthenticated compromise, including remote code execution in `CVE-2019-19781` and `CVE-2023-3519`, as well as memory disclosure in `CVE-2023-4966` (**CitrixBleed**) and the later `CVE-2025-5777` variant. Public reporting showed that `CVE-2019-19781` could be exploited through crafted HTTP requests that abused directory traversal and template parsing to execute commands on vulnerable appliances, while research on `CVE-2023-3519` examined another critical path to code execution on internet-facing Citrix infrastructure.
Jun 29, 2026
Attackers have begun attempting to exploit **CVE-2026-19490**, a critical authentication-bypass vulnerability in Citrix NetScaler ADC and NetScaler Gateway. Remote, unauthenticated actors can bypass authentication on susceptible appliances configured as AAA virtual servers or Gateway services when affected firmware versions and SAML Action settings are present; sensor data from Previdian confirms exploitation attempts, though not confirmed successful compromises. Citrix issued fixes on August 19 and urged customers to upgrade affected appliances. Australia’s ACSC and Belgium’s national cybersecurity coordination center have also called for urgent patching, warning that internet-facing edge devices are frequent initial-access targets. Organizations should identify exposed NetScaler instances and vulnerable SAML/VPN configurations, apply the relevant updates, and continue monitoring appliances after remediation. Citrix also disclosed **CVE-2026-19489**, a memory-overflow flaw affecting deployments using SIP ALG with Large Scale NAT groups.
Sep 4, 2026