CVE-2026-19490
Vulnerability in NetScaler ADC and NetScaler Gateway.
- Severity
- 9.3 / 10
- Critical · CVSS 4.0
- Exploit chance (EPSS)
- 32.65%
- Chance of exploitation in the next 30 days. Higher than 98.34% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Sep 9, 2026
- Weakness
- CWE-288 Authentication Bypass Using an Alternate Path or Channel
- Fix
- None yet
- No fixed version published
Description
Vulnerability in NetScaler ADC and NetScaler Gateway.
This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 4.0 9.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- Low
- Integrity (subsequent systems)
- Low
- Availability (subsequent systems)
- Low
- Exploit maturity
- Not defined
- Scope
- X
CVSS 3.1 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-288: Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
How to prevent it
- Architecture and Design: Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
References
Advisories
Other links
Timeline
- Published
- Added to CISA's Known Exploited Vulnerabilities catalog
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-vc32-4gwf-77xp Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools | High | Same weakness, CWE-288 |
| GHSA-hxcx-9h4f-42xx Snipe-IT: 2FA bypass via the API token flow | High | Same weakness, CWE-288 |
| GHSA-pf83-w3f9-8m37 n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions | Medium | Same weakness, CWE-288 |
| GHSA-p68q-wchp-6fh7 fastify vulnerable to authentication bypass via malformed URLs reaching encapsulated not-found handlers | High | Same weakness, CWE-288 |
| GHSA-7j72-f6wg-cxw6 SiYuan: Anonymous publish-password authentication bypass via getHeadingChildrenDOM / getHeading*Transaction / getBacklinkDoc (publish mode) | Critical | Same weakness, CWE-288 |
| CVE-2026-18577 An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1 | High Known exploited | Same weakness, CWE-288 |
| CVE-2026-18556 Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. | High Known exploited | Same weakness, CWE-288 |
| GO-2026-6207 Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass | High | Same weakness, CWE-288 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor