Skip to content
VulniPulse
Sign in
Advisory severityCritical9.3NetScaler (Citrix) Exploited CISA KEV

Critical [CVE-2026-19490] NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490

This critical-severity NetScaler (Citrix) advisory covers CVE-2026-19490 affecting Gateway.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-19490 Source published Source updated

VulniPulse record published

CVE-2026-19490
Affected products & platforms
NetScaler (Citrix)NetScaler Gateway
Open source advisory

Android app · Google Play

Monitor future NetScaler (Citrix) CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

Vulnerability in NetScaler ADC and NetScaler Gateway.

This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.

CISA Known Exploited Vulnerability

Listed:
Sep 9, 2026 · federal remediation due Sep 12, 2026
Required action:
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Ransomware use:
Unknown

KEV is a prioritization signal from CISA — remediation detail still comes from the vendor advisory.

Affected versions
  • ADC 14.1 through 73.32
  • ADC 13.1 through 63.21
  • Gateway 14.1 through 73.32
  • Gateway 13.1 through 63.21

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Fixed versions

No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Mitigation

The source record does not include mitigation steps. That is not a statement that no fix exists — read the vendor advisory below for the authoritative guidance.

Official advisory · high-confidence parse· fetched 2 months ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.