Citrix NetScaler Authentication Bypass Vulnerability Added to CISA KEV
CISA KEV · 3 sources
What's on the official record
CISA added CVE-2026-19490 to the Known Exploited Vulnerabilities Catalog on 9 September 2026. The vulnerability is an authentication bypass involving an alternate path or channel (CWE-288) in Citrix NetScaler ADC and NetScaler Gateway. CISA's remediation due date for federal civilian agencies is 12 September 2026, and the catalog version is 2026.10.21. The record names no fixed version; Citrix ADC is affected through 73.32 and 63.21. The catalog does not record known ransomware use. FIRST's EPSS model estimates a 0.232 exploitation probability (percentile 98, as of 23 October 2026). CISA's ADP records the vulnerability as actively exploited, automatable, with total impact.
Assessment
For a platform or AI-stack owner, the record lets you check whether any NetScaler ADC or NetScaler Gateway in the estate is configured as an AAA virtual server or as a Gateway, and whether it runs a version at or below 73.32 or 63.21. The record names no fixed version, so the decision is to isolate or pull affected appliances and apply the vendor's mitigation instructions until a fixed version is published.
For a cyber underwriter, the record lets you check whether a policyholder runs an affected NetScaler ADC or NetScaler Gateway version and whether it is exposed as an AAA virtual server or Gateway. CISA's ADP records the vulnerability as actively exploited and automatable with total impact, which bears on how you price or condition coverage for an unpatched appliance.
What would change this call
A vendor advisory or CVE record update naming a fixed version, or a CISA update changing the due date or exploitation status, would change the patch and underwriting guidance above.
What to check next
| Check | Why |
|---|---|
| NetScaler ADC and Gateway versions in the estate | Confirm whether any instance is at or below 73.32 or 63.21 |
| Vendor advisory CTX696939 | Apply the vendor's mitigation instructions |
| CISA KEV catalog entry | Watch for any change to due date or exploitation status |
Confidence
Filed 23 October 2026 from the record dated 9 September 2026.
Sources
[1] Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-19490
[2] CVE record CVE-2026-19490 — https://www.cve.org/CVERecord?id=CVE-2026-19490
[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog