Critical NetScaler Vulnerability Exploited in Attacks
Critical NetScaler vulnerability CVE-2026-19490 exploited in the wild since September 3.
CISA has warned that threat actors are actively exploiting a critical NetScaler vulnerability, CVE-2026-19490, which has a CVSS score of 9.3. The flaw impacts NetScaler ADC and Gateway appliances configured as gateways or AAA virtual servers. Citrix released a patch on August 19, and the vulnerability has been exploited in the wild since at least September 3, prompting CISA to add it to its Known Exploited Vulnerabilities catalog.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Citrix?
Get an email when a new story names Citrix, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical vulnerability (CVE-2026-19490, CVSS 9.3) in Citrix NetScaler ADC and Gateway appliances was actively exploited in the wild approximately two weeks after Citrix released a patch, highlighting a dangerous gap in organizational patch response times. The flaw targets gateway and AAA virtual server configurations, which are commonly internet-facing and high-value targets for threat actors. CISA's addition of this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog underscores the urgency for organizations to treat critical network appliance patches as emergency changes. The incident demonstrates that even a brief window between patch release and deployment can be sufficient for attackers to compromise critical infrastructure at scale.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-19490