CISA Warns of Active Attacks on Critical NetScaler Flaw

Key points

• CISA added CVE-2026-19490, a flaw scoring 9.3 out of 10 on the standard severity scale, to its official list of known exploited vulnerabilities on Wednesday.
• Citrix patched the vulnerability on August 19, 2026; active exploitation began September 3, one day after a working attack method appeared publicly on GitHub.
• All NetScaler ADC and NetScaler Gateway appliances configured as a gateway or authentication server are affected.
• Federal agencies must apply the patch within three days, under BOD 26-04 (Binding Operational Directive 26-04, a mandatory security instruction issued to U.S. Government departments).
• Rapid7 flagged the flaw at patch release, warning that NetScaler appliances are high-value targets that criminals move against quickly.

What is this flaw and who is at risk?

CVE-2026-19490 is a critical flaw in two Citrix products: NetScaler ADC (Application Delivery Controller, software that manages how web traffic flows into a company's network) and NetScaler Gateway (a remote-access tool that lets employees log in securely from outside the office). Both are used heavily by large organisations.

The flaw lets a criminal attack from the internet without a username or password. Most attacks require stolen credentials first. Here, none are needed.

Every appliance configured as a gateway, including SSL VPN (an encrypted remote-access tunnel), or as an authentication server is vulnerable, covering a large share of enterprise NetScaler deployments worldwide.

How did we get here?

Citrix issued a patch on August 19. Rapid7 published an analysis the same day, warning the flaw would attract criminals given how many organisations rely on NetScaler for remote access. "Organizations should prioritize patching affected systems on an emergency basis, since Citrix products are high-value targets that tend to quickly see exploitation in the wild," Rapid7 said, as reported by SecurityWeek.

On September 2, a proof-of-concept exploit (a working demonstration of how to abuse the flaw) appeared on GitHub. Exploitation was underway by September 3. Ryan Dewhurst, founder of threat-intelligence firm Previdian, observed scanning traffic almost immediately: "An unverified but credible PoC appeared yesterday. Today, 3 IPs across 3 countries sent matching requests to our sensor." CISA's public warning came roughly a week later.

This isn't an isolated pattern. Our 27 August story on six actively exploited bugs showed CISA ordering emergency patches for a separate Citrix NetScaler flaw on the same timeline.

Should employees and customers be worried?

If your employer uses Citrix NetScaler for remote access, ask your IT team whether the August 19 patch has been applied. A successful attack on an unpatched gateway can give criminals a foothold inside a corporate network, potentially leading to data theft or ransomware (malicious software that locks company files until a ransom is paid).

Ordinary users can't patch this themselves. What staff can do is watch for unusual account activity or unexpected password-reset requests, both early signs of a breach.

Common questions

Do non-government organisations have to comply with the three-day deadline?

No. BOD 26-04 legally binds U.S. Federal civilian agencies only. Private companies and state governments face no mandatory deadline under this specific rule, though regulators such as the SEC (Securities and Exchange Commission) expect publicly listed companies to manage known vulnerabilities promptly under separate disclosure obligations.

What should IT teams do right now?

Apply the Citrix patch released on August 19. Teams that can't patch immediately should consider taking affected gateway appliances offline or restricting access until the update is applied.