CVE-2026-19490
Full vulnerability record from the local CVENow database.
Description
Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.
Severity
CRITICAL
CVSS score
9.3
(v4.0)
Vulnerability status
Analyzed
Source identifier
50a63c94-1ea7-4568-8c11-eb79e7c5a2b5
Published
2026-08-19 13:17:45
Last modified
2026-10-26 13:10:00.140000
View original CVE JSON
{
"id": "CVE-2026-19490",
"sourceIdentifier": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5",
"published": "2026-08-19T13:17:45.000",
"lastModified": "2026-10-26T13:10:00.140",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Vulnerability in NetScaler ADC and NetScaler Gateway.\n\nThis issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21."
},
{
"lang": "es",
"value": "Vulnerabilidad en NetScaler ADC y NetScaler Gateway.\n\nEste problema afecta a ADC: desde 14.1 hasta 73.32 y desde 13.1 hasta 63.21; Gateway: desde 14.1 hasta 73.32 y desde 13.1 hasta 63.21."
}
],
"affected": [
{
"source": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5",
"affectedData": [
{
"vendor": "NetScaler",
"product": "ADC",
"defaultStatus": "unaffected",
"versions": [
{
"version": "14.1",
"lessThanOrEqual": "73.32",
"versionType": "patch",
"status": "affected"
},
{
"version": "13.1",
"lessThanOrEqual": "63.21",
"versionType": "patch",
"status": "affected"
}
]
},
{
"vendor": "NetScaler",
"product": "Gateway",
"defaultStatus": "unaffected",
"versions": [
{
"version": "14.1",
"lessThanOrEqual": "73.32",
"versionType": "patch",
"status": "affected"
},
{
"version": "13.1",
"lessThanOrEqual": "63.21",
"versionType": "patch",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "LOW",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-09-10T03:55:17.447903Z",
"id": "CVE-2026-19490",
"options": [
{
"exploitation": "active"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"cisaExploitAdd": "2026-09-09",
"cisaActionDue": "2026-09-12",
"cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
"cisaVulnerabilityName": "Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability",
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-288"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*",
"versionStartIncluding": "13.1",
"versionEndExcluding": "13.1-37.277",
"matchCriteriaId": "2F90F173-E24C-4189-87FF-2157DBBECE4A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:ndcpp:*:*:*",
"versionStartIncluding": "13.1",
"versionEndExcluding": "13.1-37.277",
"matchCriteriaId": "2CD7AEA1-F0D9-47E9-A4BF-6E72E2083934"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*",
"versionStartIncluding": "13.1",
"versionEndExcluding": "13.1-63.21",
"matchCriteriaId": "07826E3F-A0BA-42DB-97DD-677E2F1E99B8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:-:*:*:*",
"versionStartIncluding": "14.1",
"versionEndExcluding": "14.1-73.32",
"matchCriteriaId": "12664220-1266-43A3-A5B9-011E06C56A3E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:citrix:netscaler_application_delivery_controller:*:*:*:*:fips:*:*:*",
"versionStartIncluding": "14.1-66.68",
"versionEndIncluding": "14.1-73.32",
"matchCriteriaId": "98857F06-6895-4454-A52D-E200D2109B19"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*",
"versionStartIncluding": "13.1",
"versionEndExcluding": "13.1-63.21",
"matchCriteriaId": "0ACEC99D-8145-45D4-BFCC-ADC11999D2CF"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:citrix:netscaler_gateway:*:*:*:*:*:*:*:*",
"versionStartIncluding": "14.1",
"versionEndExcluding": "14.1-73.32",
"matchCriteriaId": "45606A9C-06AF-4A4B-80B4-CB1A29230C85"
}
]
}
]
}
],
"references": [
{
"url": "https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939",
"source": "50a63c94-1ea7-4568-8c11-eb79e7c5a2b5",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19490",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"US Government Resource"
]
}
]
}