[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-19490":6},{"stargazers_count":4,"fetched_at":5},7,"2026-09-10T04:22:39.150Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":262,"aliases":263,"duplicate_of":9,"upstream":264,"downstream":265,"duplicates":266,"related":267,"reserved_at":9,"published_at":268,"modified_at":269,"state":270,"summary":271,"references_raw":282,"kevs":293,"epss":304,"epss_history":306,"metrics":371,"affected":378},"CVE-2026-19490","Vulnerability in NetScaler ADC and NetScaler Gateway.\n\nThis issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1 through 73.32 and from 13.1 through 63.21.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":9,"capec":18},"CWE-288","Authentication Bypass Using an Alternate Path or Channel","The product requires authentication, but the product has an alternate path or channel that does not require authentication.","weakness","Incomplete","Base",[19,81],{"id":20,"name":21,"techniques":22},"CAPEC-127","Directory Indexing",[23],{"id":24,"name":25,"tactics":26,"countermeasures":30},"T1083","File and Directory Discovery",[27],{"id":28,"name":29},"TA0102","Discovery",[31,36,41,46,51,55,59,63,67,72,76],{"id":32,"name":33,"tactic":34},"D3-CQ","Content Quarantine",{"name":35},"Isolate",{"id":37,"name":38,"tactic":39},"D3-FE","File Encryption",{"name":40},"Harden",{"id":42,"name":43,"tactic":44},"D3-DF","Decoy File",{"name":45},"Deceive",{"id":47,"name":48,"tactic":49},"D3-FA","File Analysis",{"name":50},"Detect",{"id":52,"name":53,"tactic":54},"D3-FIM","File Integrity Monitoring",{"name":50},{"id":56,"name":57,"tactic":58},"D3-LFP","Local File Permissions",{"name":35},{"id":60,"name":61,"tactic":62},"D3-CF","Content Filtering",{"name":35},{"id":64,"name":65,"tactic":66},"D3-RFAM","Remote File Access Mediation",{"name":35},{"id":68,"name":69,"tactic":70},"D3-RF","Restore File",{"name":71},"Restore",{"id":73,"name":74,"tactic":75},"D3-CM","Content Modification",{"name":35},{"id":77,"name":78,"tactic":79},"D3-FEV","File Eviction",{"name":80},"Evict",{"id":82,"name":83,"techniques":84},"CAPEC-665","Exploitation of Thunderbolt Protection Flaws",[85,120,159],{"id":86,"name":87,"tactics":88,"countermeasures":95},"T1211","Exploitation for Stealth",[89,92],{"id":90,"name":91},"TA0030","Defense Evasion",{"id":93,"name":94},"TA0005","Stealth",[96,100,104,108,112,116],{"id":97,"name":98,"tactic":99},"D3-PSEP","Process Segment Execution Prevention",{"name":40},{"id":101,"name":102,"tactic":103},"D3-MBT","Memory Boundary Tracking",{"name":50},{"id":105,"name":106,"tactic":107},"D3-PCSV","Process Code Segment Verification",{"name":50},{"id":109,"name":110,"tactic":111},"D3-SFCV","Stack Frame Canary Validation",{"name":40},{"id":113,"name":114,"tactic":115},"D3-SSC","Shadow Stack Comparisons",{"name":50},{"id":117,"name":118,"tactic":119},"D3-SAOR","Segment Address Offset Randomization",{"name":40},{"id":121,"name":122,"tactics":123,"countermeasures":129},"T1542.002","Component Firmware",[124,125,126],{"id":90,"name":91},{"id":93,"name":94},{"id":127,"name":128},"TA0110","Persistence",[130,134,138,142,146,151,155],{"id":131,"name":132,"tactic":133},"D3-FEMC","Firmware Embedded Monitoring Code",{"name":50},{"id":135,"name":136,"tactic":137},"D3-FV","Firmware Verification",{"name":50},{"id":139,"name":140,"tactic":141},"D3-FBA","Firmware Behavior Analysis",{"name":50},{"id":143,"name":144,"tactic":145},"D3-SU","Software Update",{"name":40},{"id":147,"name":148,"tactic":149},"D3-SWI","Software Inventory",{"name":150},"Model",{"id":152,"name":153,"tactic":154},"D3-RS","Restore Software",{"name":71},{"id":156,"name":157,"tactic":158},"D3-AVE","Asset Vulnerability Enumeration",{"name":150},{"id":160,"name":161,"tactics":162,"countermeasures":171},"T1556","Modify Authentication Process",[163,164,167,168],{"id":90,"name":91},{"id":165,"name":166},"TA0112","Defense Impairment",{"id":127,"name":128},{"id":169,"name":170},"TA0031","Credential Access",[172,174,178,180,184,188,190,194,198,202,206,210,214,216,218,220,222,224,228,232,234,238,242,244,246,250,254,258],{"id":56,"name":57,"tactic":173},{"name":35},{"id":175,"name":176,"tactic":177},"D3-HBPI","Hardware-based Process Isolation",{"name":35},{"id":77,"name":78,"tactic":179},{"name":80},{"id":181,"name":182,"tactic":183},"D3-HS","Host Shutdown",{"name":80},{"id":185,"name":186,"tactic":187},"D3-PSMD","Process Self-Modification Detection",{"name":50},{"id":32,"name":33,"tactic":189},{"name":35},{"id":191,"name":192,"tactic":193},"D3-ABPI","Application-based Process Isolation",{"name":35},{"id":195,"name":196,"tactic":197},"D3-SFA","System File Analysis",{"name":50},{"id":199,"name":200,"tactic":201},"D3-PT","Process Termination",{"name":80},{"id":203,"name":204,"tactic":205},"D3-SCF","System Call Filtering",{"name":35},{"id":207,"name":208,"tactic":209},"D3-AM","Access Modeling",{"name":150},{"id":211,"name":212,"tactic":213},"D3-RC","Restore Configuration",{"name":71},{"id":37,"name":38,"tactic":215},{"name":40},{"id":42,"name":43,"tactic":217},{"name":45},{"id":52,"name":53,"tactic":219},{"name":50},{"id":60,"name":61,"tactic":221},{"name":35},{"id":47,"name":48,"tactic":223},{"name":50},{"id":225,"name":226,"tactic":227},"D3-WSAM","Web Session Access Mediation",{"name":35},{"id":229,"name":230,"tactic":231},"D3-CI","Configuration Inventory",{"name":150},{"id":68,"name":69,"tactic":233},{"name":71},{"id":235,"name":236,"tactic":237},"D3-PSA","Process Spawn Analysis",{"name":50},{"id":239,"name":240,"tactic":241},"D3-PLA","Process Lineage Analysis",{"name":50},{"id":64,"name":65,"tactic":243},{"name":35},{"id":73,"name":74,"tactic":245},{"name":35},{"id":247,"name":248,"tactic":249},"D3-NTPM","Network Traffic Policy Mapping",{"name":150},{"id":251,"name":252,"tactic":253},"D3-KBPI","Kernel-based Process Isolation",{"name":35},{"id":255,"name":256,"tactic":257},"D3-PS","Process Suspension",{"name":80},{"id":259,"name":260,"tactic":261},"D3-HR","Host Reboot",{"name":80},[],[],[],[],[],[],"2026-08-19T12:54:39.730Z","2026-09-10T03:55:17.040Z","Undergoing Analysis",{"cisa_kev":272,"cisa_ransomware":273,"cisa_vendor":274,"epss_severity":275,"epss_score":276,"severity":277,"severity_score":278,"severity_version":279,"severity_source":280,"severity_vector":281,"severity_status":270},true,false,"Citrix","low",0.03372,"critical",9.3,"v4.0","cve.org","CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",[283,288],{"url":284,"sources":285,"tags":287},"https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939",[280,286],"nvd",[],{"url":289,"sources":290,"tags":291},"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19490",[280,286],[292],"Government Resource",[294],{"source":295,"vendor":274,"product":296,"date_added":297,"vulnerability_name":298,"short_description":299,"required_action":300,"due_date":301,"known_ransomware_campaign_use":302,"notes":303,"exploitation_type":9},"cisa","NetScaler","2026-09-09","Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability","Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","2026-09-12","Unknown","https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-19490",{"date":297,"score":276,"percentile":305},0.88028,[307,311,315,318,321,325,328,331,334,337,340,343,346,349,352,355,358,361,364,367,370],{"date":308,"score":309,"percentile":310},"2026-08-20",0.00345,0.27736,{"date":312,"score":313,"percentile":314},"2026-08-21",0.00327,0.2577,{"date":316,"score":313,"percentile":317},"2026-08-22",0.25785,{"date":319,"score":313,"percentile":320},"2026-08-23",0.25729,{"date":322,"score":323,"percentile":324},"2026-08-24",0.00402,0.33004,{"date":326,"score":323,"percentile":327},"2026-08-25",0.3303,{"date":329,"score":276,"percentile":330},"2026-08-26",0.87856,{"date":332,"score":276,"percentile":333},"2026-08-27",0.87869,{"date":335,"score":276,"percentile":336},"2026-08-28",0.87903,{"date":338,"score":276,"percentile":339},"2026-08-29",0.87914,{"date":341,"score":276,"percentile":342},"2026-08-30",0.87895,{"date":344,"score":276,"percentile":345},"2026-08-31",0.87899,{"date":347,"score":276,"percentile":348},"2026-09-01",0.87908,{"date":350,"score":276,"percentile":351},"2026-09-02",0.87921,{"date":353,"score":276,"percentile":354},"2026-09-03",0.87926,{"date":356,"score":276,"percentile":357},"2026-09-04",0.87936,{"date":359,"score":276,"percentile":360},"2026-09-05",0.87973,{"date":362,"score":276,"percentile":363},"2026-09-06",0.87957,{"date":365,"score":276,"percentile":366},"2026-09-07",0.8796,{"date":368,"score":276,"percentile":369},"2026-09-08",0.87968,{"date":297,"score":276,"percentile":305},[372,375],{"source":280,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":373},{"baseScore":278,"baseSeverity":374,"vectorString":281,"impactScore":9,"exploitabilityScore":9},"CRITICAL",{"source":286,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":9,"cvss_v4_0":376},{"baseScore":278,"baseSeverity":374,"vectorString":377,"impactScore":9,"exploitabilityScore":9},"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",[379,394],{"ecosystem":9,"name":380,"vendor":381,"product":382,"cpe_part":383,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":384},"ADC","netscaler","adc","a",[385,390],{"version":386,"is_range":272,"range_type":280,"version_start":387,"version_start_type":388,"version_end":389,"version_end_type":388,"fixed_in":9},">= 14.1, \u003C= 73.32","14.1","including","73.32",{"version":391,"is_range":272,"range_type":280,"version_start":392,"version_start_type":388,"version_end":393,"version_end_type":388,"fixed_in":9},">= 13.1, \u003C= 63.21","13.1","63.21",{"ecosystem":9,"name":395,"vendor":381,"product":396,"cpe_part":383,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":397},"Gateway","gateway",[398,399],{"version":386,"is_range":272,"range_type":280,"version_start":387,"version_start_type":388,"version_end":389,"version_end_type":388,"fixed_in":9},{"version":391,"is_range":272,"range_type":280,"version_start":392,"version_start_type":388,"version_end":393,"version_end_type":388,"fixed_in":9}]