Netscaler CVE-2026-19490 Zero-Day Added to CISA KEV Under Active Exploitation
Key findings • CVE-2026-19490, a Netscaler vulnerability, has been added to CISA KEV due to active exploitation. • The flaw poses an immediate and significant risk to organizations using affe…
Key findings
- CVE-2026-19490, a Netscaler vulnerability, has been added to CISA KEV due to active exploitation.
- The flaw poses an immediate and significant risk to organizations using affected Netscaler products.
- There is no current indication that this vulnerability is associated with ransomware campaigns.
- Federal agencies must remediate by September 30, 2026; all organizations should patch immediately.
CISA has added CVE-2026-19490, a critical vulnerability affecting Netscaler products, to its Known Exploited Vulnerabilities (KEV) catalog. This inclusion signals that the flaw is under active exploitation by malicious actors, posing an immediate and significant risk to organizations utilizing affected Netscaler systems. The addition to the KEV catalog underscores the urgency for all organizations to address this vulnerability without delay.
CVE-2026-19490 is a newly identified zero-day vulnerability. While specific technical details of the exploit are not publicly disclosed at this time, its presence in the KEV catalog confirms that adversaries are actively leveraging it to compromise systems. There is currently no information indicating that this particular vulnerability is tied to ransomware campaigns, but its active exploitation status means it could be used for initial access, data exfiltration, or other malicious activities.
For federal civilian executive branch (FCEB) agencies, CISA mandates remediation of CVE-2026-19490 by September 30, 2026. However, all organizations, regardless of sector, are strongly advised to prioritize patching or applying available mitigations immediately. Proactive defense against actively exploited vulnerabilities is paramount to safeguarding critical assets and preventing potential breaches. Organizations should consult official Netscaler advisories for the latest patching information and guidance.
The US Cybersecurity and Infrastructure Security Agency (CISA) has officially added CVE-2026-19490 to its Known Exploited Vulnerabilities (KEV) catalog, reinforcing the urgency for organizations to patch their NetScaler ADC and NetScaler Gateway appliances. This inclusion mandates federal agencies to apply the necessary patches within three days, highlighting the active exploitation of this critical authentication bypass flaw.
The new article provides further detail on the exploitation attempts, noting that security researchers observed attack requests targeting honeypot systems starting September 3rd, with 56 attempts logged through September 8th. While these attempts indicate active exploitation, they do not confirm successful compromises of production environments. The article also specifies the affected versions of NetScaler ADC and Gateway, including both standard and FIPS builds, and highlights that newer vulnerable installations require specific configuration conditions like SAML identity provider roles.