Citrix · NetScaler
CVE-2026-19490
NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490
Qué es
Vulnerability in NetScaler ADC and NetScaler Gateway.
This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.
CISA: Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.
Qué hacer
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Plazo para las agencias federales de EE. UU.: 12 de septiembre de 2026
- Añadida a la lista de CISA
- 9 de septiembre de 2026
- Publicada
- 19 de agosto de 2026
- Gravedad
- Crítica 9,3 CVSS 4.0
- Probabilidad de ataques en los próximos 30 días (EPSS)
- 33% entre el 1,7% superior de todas las vulnerabilidades conocidas
- Debilidad
- CWE-288
- Más detalles
- NVD · CVE.org · CISA
Todas las referencias (1)
Más fallos explotados de Citrix
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 4 oct 2026 | Improper Restriction of Operations within the Bounds of a Memory Buffer | NetScaler | Alto 8,7 | 11% |
| 27 sept 2026 | Improper Input Validation | NetScaler | Crítica 9,5 | 82% |
| 27 sept 2026 | Improper Restriction of Operations within the Bounds of a Memory Buffer | NetScaler | Crítica 9,5 | 78% |
| 30 mar 2026 | Out-of-Bounds Read | NetScaler | Crítica 9,3 | 91% |
| 26 ago 2025 | Memory Overflow | NetScaler | Crítica 9,2 | 21% |
| 26 ago 2026 | Improper Restriction of Operations within the Bounds of a Memory Buffer | NetScaler ADC and NetScaler Gateway | Alto 8,8 | 1,0% |
| 25 ago 2025 | Improper Privilege Management | Session Recording | Media 5,1 | 3,5% |
| 25 ago 2025 | Deserialization of Untrusted Data | Session Recording | Media 5,1 | 21% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.