Column 1
Skip to content

NetScaler CVE-2026-19490 Is in CISA KEV: Update ADC and Gateway

September 9, 2026

CVE-2026-19490 is a critical NetScaler ADC and Gateway authentication-bypass vulnerability that CISA added to its Known Exploited Vulnerabilities catalog on September 9, 2026. Organizations running affected customer-managed appliances should prioritize the vendor’s security update. This is a new KEV addition, not a new disclosure: the vendor bulletin was first published on August 19.

This guide describes source-confirmed product risk. Fix I.T. Phill has not assessed your appliance or determined that any particular organization has been compromised.

Who Needs to Check Their Deployment?

The affected configuration is a Gateway or AAA virtual server, with SAML-related requirements that vary by software build. The vendor also includes customer-managed NetScaler instances used with Secure Private Access Hybrid. Citrix-managed cloud services are maintained by the vendor; do not assume that a customer-managed appliance receives the same automatic correction.

Review the configuration and exact build in your approved administration console against the official NetScaler bulletin. The SAML prerequisite differs between older and newer 14.1 and 13.1 builds and the FIPS branches. A product name or a major-version number alone is not enough to establish exposure.

Vendor-Recommended Fixed Builds

  • NetScaler ADC and Gateway 14.1: 14.1-73.32 or a later supported release.
  • NetScaler ADC and Gateway 13.1: 13.1-63.21 or a later supported 13.1 release.
  • NetScaler ADC 14.1-FIPS: 14.1-73.32 FIPS or a later supported 14.1-FIPS release.
  • NetScaler ADC 13.1-FIPS and 13.1-NDcPP: 13.1-37.277 or a later supported release in the matching branch.

Source-boundary note: the vendor bulletin identifies those builds as corrected, while the current CNA record expresses inclusive affected boundaries for the standard branches. Use the vendor’s current fixed-build instructions for deployment, and obtain vendor clarification if an inventory tool disagrees. Do not treat this article as a replacement for branch-specific support guidance.

Plan and Apply the Update

  1. Identify ownership and scope. Record the appliance role, exact build, branch, relevant authentication configuration and maintenance owner. Distinguish production, test and standby appliances.
  2. Prepare recovery before maintenance. Confirm that your existing configuration-recovery process is usable, that approved recovery access is available, and that the selected image supports your hardware and configuration. Plan the maintenance window and business communication.
  3. Follow the supported update path. Obtain the matching image from the vendor and follow its upgrade instructions. For highly available deployments, use the documented maintenance order and confirm peer health before moving to the next appliance.
  4. Keep access controlled. Review who can reach management services while the update is scheduled. Reduced exposure is a supporting control, not a substitute for the security correction.
  5. Escalate suspicious activity separately. Preserve relevant evidence through your normal incident-response process and involve the vendor or response team. Installing an update does not by itself establish that an appliance was never compromised.

Verify the Result Safely

After maintenance, record the running build and verify appliance and peer health through normal administrative views. Test expected remote-access and business sign-ins with approved test accounts, confirm monitoring and alert delivery, and watch for unexpected authentication or availability changes. Do not test the vulnerability against a live appliance.

CISA lists September 12 as this entry’s due date. Organizations covered by the applicable directive should follow its requirements; other organizations should prioritize according to their own risk and change processes. The date is not a reason to postpone an available fix.

Related Maintenance Guidance

The earlier NetScaler KEV checklist covers different vulnerabilities and does not replace this bulletin. Teams coordinating website access or customer sign-in checks can use Fix I.T. Phill WordPress support for the application-side maintenance work; appliance remediation remains the responsibility of the authorized network administrator.

Sources and Validation

Reviewed September 9, 2026 against the vendor bulletin, NetScaler CNA record, and CISA KEV catalog. No customer appliance testing was performed. The featured image is an illustration, not evidence of a completed customer update.