NetScaler ADC CVE-2026-19489

No special conditions are required beyond network reachability to the affected NetScaler ADC or Gateway appliance running a vulnerable build (13.1 through 63.21 or 14.1 through 73.32). The CVSS 4.0 vector specifies AV:N/AC:L/AT:N/PR:N/UI:N, confirming remote, unauthenticated exploitation against default-deployed configurations with no interaction required. The key limiting factor is build version: appliances already patched to a build beyond the affected ranges are not vulnerable. Appliances not internet-facing and accessible only from trusted internal networks have significantly reduced exposure, but internal network reachability still satisfies the AV:N condition. No specific feature flag, protocol mode, or non-default configuration is described as a prerequisite in the available data.

The CVSS 4.0 base score of 8.8 is driven primarily by VA:H against a network-accessible, unauthenticated attack surface with no complexity or interaction requirements - a combination that is operationally dangerous for perimeter appliances. The AV:N/PR:N/UI:N trifecta means any internet-connected NetScaler instance within the affected build range is potentially reachable. Confidentiality (VC:L) and integrity (VI:L) impacts are present but secondary; the primary concern is service disruption, which for a load balancer or VPN gateway translates to loss of availability for downstream applications and remote users. SA:L on subsequent systems reflects collateral availability impact on traffic flowing through the appliance. No EPSS score was provided in the source data, so exploitation probability cannot be quantified numerically. KEV status is negative and no POC has been identified, reducing the immediate active-threat signal - however, NetScaler appliances have historically been high-value targets (see prior CVE-2023-3519, CVE-2023-4966) and vulnerabilities in this product class attract rapid weaponization. The CWE being listed as N/A is a gap: without a root cause class, it is not possible to assess whether the flaw is straightforward to exploit from a protocol-level trigger or requires deeper knowledge of internals. Overall, this is a genuine priority for organizations with internet-exposed NetScaler instances.

An unauthenticated remote attacker sends a specially crafted network request to a NetScaler ADC or Gateway instance running an affected build. The request triggers a flaw in the appliance's network-facing processing layer, causing the service to crash or become unavailable and potentially leaking limited data artifacts in the process. No public exploit code has been identified at time of analysis, but the low-complexity, zero-authentication attack surface makes this a viable target for opportunistic exploitation once technical details become more widely known.