CVE-2026-19490KEV · OVERDUECWE-288

Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

Critical · published August 19, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 97.8th percentile for exploit probability.

42
days past CISA
deadline
CVSS v3.1
9.8
EPSS
23%
Percentile
97.8
In the wild
Confirmed
What it is

Vulnerability in NetScaler ADC and NetScaler Gateway.

This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
EPSS
0.23158 · 97.8th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2026-08-19T17:17Z
KEV added
2026-09-09 · due 2026-09-12
Affected products (7)
ProductVersionsFixed in
citrix/netscaler_application_delivery_controller≥ 13.1, < 13.1-37.27713.1-37.277
citrix/netscaler_application_delivery_controller≥ 13.1, < 13.1-37.27713.1-37.277
citrix/netscaler_application_delivery_controller≥ 13.1, < 13.1-63.2113.1-63.21
citrix/netscaler_application_delivery_controller≥ 14.1, < 14.1-73.3214.1-73.32
citrix/netscaler_application_delivery_controller≥ 14.1-66.68, ≤ 14.1-73.32—
citrix/netscaler_gateway≥ 13.1, < 13.1-63.2113.1-63.21
citrix/netscaler_gateway≥ 14.1, < 14.1-73.3214.1-73.32
References (2)
https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939 · 50a63c94-1ea7-4568-8c11-eb79e7c5a2b5https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19490 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 03 OCT 03:42Z
    EPSS moved 7% → 23%
    epss
  • 19 AUG 12:54Z
    NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
    cvelistv5