Skip to content
OpenAdvisories
Critical · 9.3 Known exploited Public exploit CVE-2026-19490 EUVD-2026-62395GHSA-7c6h-rhhv-wm8r

NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490

Published Aug 19, 2026 · Updated Oct 7, 2026 · Assigned by NetScaler

Vendor: NetScaler Product: ADC Product: Gateway

Description

Vulnerability in NetScaler ADC and NetScaler Gateway.

This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.

Affected products

VendorProductAffectedFixed
NetScaler ADC 14.1 – ≤ 73.32, 13.1 – ≤ 63.21 —
NetScaler Gateway 14.1 – ≤ 73.32, 13.1 – ≤ 63.21 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 3 repositories

  • TarPeg007/CVE-2026-19490 ★ 19 · Sep 2, 2026

    NetScaler ADC/Gateway SAML unsigned-assertion bypass via HTTP-Redirect binding (CTX696939) - root cause analysis + PoC

  • BishopFox/CVE-2026-19490-check ★ 1 · Sep 10, 2026

    Safely detect Citrix NetScaler SAML auth bypass CVE-2026-19490

  • CompleteTech-Security/netscaler-cve-2026-19490-check ★ 0 · Oct 23, 2026

    Offline NetScaler ADC / Gateway evidence checker for CVE-2026-19490. Reported firmware and configuration evidence. Standalone Python; JSON/CSV/HTML reports; no exploit payloads.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 2

References