CVE-2026-19490

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Oct 7, 2026

Description

Vulnerability in NetScaler ADC and NetScaler Gateway.

This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-288

Affected software

No affected versions have been published.

Timeline

Published
Aug 19, 2026
Last modified
Oct 7, 2026
Added to CISA KEV
Sep 9, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-194917.5IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass CVE-2026-194923.2IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerabilCVE-2026-194937.5IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to performCVE-2026-194946.5IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacCVE-2026-194987.5IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to cause aCVE-2026-194997.7Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a cCVE-2026-19509.8Delta Electronics AS320T has No checking of the length of the buffer with the file name vulnerability.CVE-2026-195007.5The Entries component in Brainstorm Force SureForms version, less than 2.12.3, does not enforce adequate limits on user-controlled form fielCVE-2026-195018.8CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to neutralize spreadsheet formula characters in user-controCVE-2026-195025.5MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on diskCVE-2026-195036.5MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an CVE-2026-195044.0Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability. This vulnerability allows remote attackers to disclose sensitive informati
CVE-2026-19490: Critical severity, CVSS 9.8 | Vulnix