CVE-2026-19490

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Oct 26, 2026

Description

Vulnerability in NetScaler ADC and NetScaler Gateway.

This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-288

Affected software

Vendor	Product	Versions
NetScaler	ADC	>= 14.1, <= 73.32; >= 13.1, <= 63.21
NetScaler	Gateway	>= 14.1, <= 73.32; >= 13.1, <= 63.21

References

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19490US Government Resource

Timeline

Published: Aug 19, 2026
Last modified: Oct 26, 2026
Added to CISA KEV: Sep 9, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-194917.5IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass CVE-2026-194923.2IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerabil CVE-2026-194937.5IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to perform CVE-2026-194946.5IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attac CVE-2026-194987.5IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to cause a CVE-2026-194997.7Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a c CVE-2026-19509.8Delta Electronics AS320T has No checking of the length of the buffer with the file name vulnerability.CVE-2026-195007.5The Entries component in Brainstorm Force SureForms version, less than 2.12.3, does not enforce adequate limits on user-controlled form fiel CVE-2026-195018.8CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to neutralize spreadsheet formula characters in user-contro CVE-2026-195025.5MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk CVE-2026-195036.5MongoDB Schema Manager and MongoDB Atlas SQL ODBC Driver do not validate the scheme of the authorization and token endpoints returned by an CVE-2026-195044.0Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability. This vulnerability allows remote attackers to disclose sensitive informati