Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-19490

CVE-2026-19490CRITICAL

NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   N   H   H   H    9.3   .2316   97.7   YES

AFFECTED
  Product  Versions  Fixed
  ADC      14.1 –    —
  Gateway  14.1 –    —

TIMELINE
  Aug 10  Reserved by NetScaler
  Aug 19  Published (CNA: NetScaler)
  Sep 9   ADDED TO KEV — CVE-2026-19490 (NetScaler ADC). Remediation due September 12, 2026.
  Sep 13  DUE DATE PASSED — CVE-2026-19490 (NetScaler ADC). CISA remediation deadline was September 12, 2026; still in catalog.

CWE-288 · CNA: NetScaler · CVSS v4.0 · 2 references · NVD status: Analyzed · KEV due September 12, 2026

Description

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
August 10, 2026	Reserved	Reserved by NetScaler
August 19, 2026	Published	Published (CNA: NetScaler)
September 9, 2026	KEV ADDED	ADDED TO KEV — CVE-2026-19490 (NetScaler ADC). Remediation due September 12, 2026.
September 13, 2026	DUE DATE PASSED	DUE DATE PASSED — CVE-2026-19490 (NetScaler ADC). CISA remediation deadline was September 12, 2026; still in catalog.

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
NetScaler	ADC	—	14.1	—
NetScaler	Gateway	—	14.1	—

Weaknesses

CWE-288

References (2)

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939 [Vendor Advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19490 [US Government Resource]

Authoritative record: CVE-2026-19490 at cve.org

Vendors: netscaler

Weaknesses: CWE-288

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-19490 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.