NetScaler ADC CVE-2026-19490

Exploitation requires network reachability to an affected NetScaler ADC or NetScaler Gateway running 14.1 (up to 73.32) or 13.1 (up to 63.21); per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no user interaction, and no special attack requirements are needed against a reachable instance. In practice the realistic prerequisite is that the vulnerable virtual server - most impactfully the Gateway/VPN or AAA vServer, or an exposed management interface - is reachable by the attacker; appliances with these services confined to an internal or management-only network are correspondingly harder to reach. The main limiting factor is therefore network exposure of the vulnerable service rather than any credential or configuration gate, and the exact vulnerable feature/endpoint should be confirmed against Citrix CTX696939.

The signals point to a genuinely high-priority issue rather than an inflated score: the CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity, and availability impact to the vulnerable system, meaning a remote, unauthenticated attacker can exploit default-facing configurations with no user interaction. There is, however, a signal conflict worth verifying - the tags label this strictly 'Information Disclosure' (a confidentiality event), yet the vendor CVSS vector asserts VI:H and VA:H (high integrity and availability impact); these should be reconciled against the Citrix advisory, as pure info-disclosure would normally not carry high I/A. No EPSS score, KEV status, or POC indicator was supplied, so real-world exploitation frequency cannot be quantified from this data alone; absence of a KEV entry here is not proof of non-exploitation. Given that NetScaler Gateway is typically internet-exposed and that this product family has a strong track record of rapid mass exploitation, any organization running an affected build - from a large enterprise down to a mid-sized municipal IT team - should treat patching as urgent. Overall: treat as an emergency-patch candidate pending confirmation of the impact scope and fixed version from the vendor.

An attacker locates an internet-exposed NetScaler Gateway login or VPN endpoint and sends a crafted unauthenticated HTTP request that causes the appliance to return sensitive in-memory data. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials, user interaction, or special timing are required, and leaked session tokens could be replayed to hijack an authenticated user's session. No public exploit identified at time of analysis, but the low complexity makes weaponization straightforward if details are published.