External risk intelligence

NetScaler ADC and Gateway Vulnerability Allows Network Takeover.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-19490

NetScaler ADC and NetScaler Gateway are infrastructure components specifically designed to be deployed at the network edge to manage traffic, provide load balancing, and facilitate remote access, making them public-facing by design in standard deployments.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in NetScaler ADC and NetScaler Gateway products, which are widely used for managing network traffic and providing remote access. This issue could potentially impact the confidentiality, integrity, and availability of services these products manage. The main concern is confirming relevance and exposure across your deployed instances.

Issue allows unauthorized access to sensitive systems.
Leadership should remember this impacts critical infrastructure.
Confirm relevance and understand potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by targeting NetScaler ADC or NetScaler Gateway devices that are exposed to the internet. Without requiring any authentication or user interaction, an attacker could exploit this vulnerability by sending specially crafted network traffic to the vulnerable component. This could lead to a compromise of the affected system.

No authentication or user interaction needed.
Triggered by network traffic.
Risk of system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in NetScaler ADC and NetScaler Gateway could affect system data and service behavior when exposed to a network. Specifically, it might impact the confidentiality, integrity, and availability of these systems.

System data and service behavior at risk.
Exposure can occur over the network.
Potential for significant system impact.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in NetScaler ADC and NetScaler Gateway requires immediate attention from infrastructure and platform teams. The first practical step is to identify all instances of the affected NetScaler products, determine their exposure and business criticality, and then coordinate with the accountable owners to plan remediation.

Infrastructure and platform teams own this.
Verify external reachability and business criticality.
Plan coordinated remediation and vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NetScaler ADC and NetScaler Gateway?

NetScaler ADC is a tool for load balancing and managing network traffic to ensure applications perform well. NetScaler Gateway provides secure remote access for users to reach internal company resources. Together, these products act as infrastructure gateways that connect users to applications, often sitting at the edge of a network to filter and route traffic effectively.

What does this CVE-2026-19490 vulnerability mean?

CVE-2026-19490 refers to a critical security flaw in NetScaler products that could allow an unauthorized person to take control of the system. It enables someone to impact the confidentiality, integrity, and availability of the services the software manages, essentially breaking the protection or data handling that the gateway is supposed to provide.

How is this vulnerability triggered?

The vulnerability is triggered by sending specially crafted network traffic directly to the NetScaler device. Because the system can be compromised remotely without needing a username, password, or any interaction from a legitimate user, it is considered highly accessible to an attacker. Standard, legitimate traffic that follows expected protocols does not trigger this flaw.

Do I need to worry if my device is on the internet?

Yes. According to Halo Surface Signal, NetScaler ADC and Gateway are designed to be deployed at the network edge to manage traffic and provide remote access, making them public-facing by design. Because this vulnerability is reachable over the network without authentication, any instance that is exposed to the internet is at significantly higher risk compared to those kept on internal networks.

What should I do first to respond to this?

The first step is to create a complete inventory of all NetScaler ADC and Gateway instances in your environment. Once identified, evaluate which devices are reachable from the internet and determine the business importance of each. Use this information to coordinate with your team to plan and prioritize the necessary security updates provided by the vendor.

References

support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.