ctrlINT What the industry said about every indicator, with the quote

CVE-2026-19490Vulnerability

Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability

Exploited in the wildCISA added it to its Known Exploited Vulnerabilities list on .

Reported by 9 independent sources · first reported by Rapid7 · last reported

Last reported 11 days ago

CISA KEVAdded 9 Sep 2026
Fix due 12 Sep 2026
Used by ransomware: not knownCISA KEV catalogue
EPSS23.2%
higher than 97% of CVEsFIRST EPSS, as of 23 Oct 2026

What the reports say

11 reports, newest first · the exact sentence from each

  1. “CVE-2026-19490”

    Recorded FutureVendor
    September 2026 CVE Landscape

  2. “Exploitation attempts against Citrix NetScaler CVE-2026-19490”

    CERT-EUGovernment
    Cyber Brief 26-10 - September 2026

  3. “CVE-2026-19490 | Citrix NetScaler ADC and NetScaler Gateway Authentication Bypass Vulnerability”

    Horizon3.aiVendor
    CVE-2026-19490 | Citrix NetScaler ADC and NetScaler Gateway Authentication Bypass Vulnerability

  4. “The two zero-day issues are not related to NetScaler vulnerabilities CVE-2026-19490 and CVE-2026-19489 that were disclosed in August.”

    Security AffairsNewsCalled not malicious in this report
    U.S. CISA adds Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog

  5. “CISA’s KEV catalog currently contains over a dozen Citrix NetScaler vulnerabilities, including the recently added CVE-2026-19490 and CVE-2026-8452.”

    SecurityWeekNews
    Citrix Confirms 2 NetScaler Zero-Days After Admins Pulled the Plug

  6. “The two zero-day issues are not related to NetScaler vulnerabilities CVE-2026-19490 and CVE-2026-19489 that were disclosed in August.”

    Security AffairsNews
    Citrix Confirmed Two New NetScaler Flaws Exploited as Zero-Day

  7. “Are these zero-day vulnerabilities related to CVE-2026-19490 and CVE-2026-19489?”

    TenableVendor
    Frequently asked questions about reported Citrix NetScaler zero-day vulnerabilities

  8. “The new flaws are not the authentication bypass, CVE-2026-19490, that Citrix fixed on August 19 and that CISA added to its Known Exploited Vulnerabilities catalog on September 9.”

    The Hacker NewsNewsCalled not malicious in this report
    Warning: Two Unpatched Citrix NetScaler RCE Zero-Days Under Active Exploitation

  9. “The vulnerability (CVE-2026-19490) was patched in August and allows attackers to bypass authentication and run commands on the device.”

    Risky Business NewsNews
    Risky Bulletin: BEC campaign steals €35 million from French notaries

  10. “Citrix has published patches for CVE-2026-19489 and CVE-2026-19490 affecting NetScaler ADC and NetScaler Gateway.”

    Check Point ResearchVendor
    24th August – Threat Intelligence Report

  11. “CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway”

    Rapid7Vendor
    CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway

Indicators reported together

named in the same reports

Also named with it: CVE-2026-19489, CVE-2026-88771, CVE-2026-88772, CVE-2026-65660, CVE-2026-85046, CVE-2026-87491, CVE-2026-83548, CVE-2026-83549, CVE-2026-82329, CVE-2026-60004, CVE-2022-0847, CVE-2026-35273, CVE-2026-85880, CVE-2026-48710, CVE-2025-39964, CVE-2026-20316, CVE-2026-39987, CVE-2026-60137, CVE-2026-63030, CVE-2021-29441

Thanks — we review every report.

Report a wrong value
What is wrong with CVE-2026-19490 here?
No account needed. We do not store your IP address.