CISA has added CVE-2026-19490, an authentication bypass in Citrix NetScaler ADC and Gateway, to its Known Exploited Vulnerabilities catalog. The agency listed it alongside CVE-2026-20079 and CVE-2025-25249. Federal civilian agencies had until September 12, 2026, to patch all three.<\/p>\n
The grouping isn’t coincidental. NetScaler, Cisco’s Secure Firewall Management Center, and Fortinet’s FortiOS all sit at the network edge, where they broker VPN<\/a> sessions, manage firewall fleets, or terminate remote access. Compromise at that layer can undermine authentication, segmentation, and visibility across an entire environment before an endpoint agent ever sees a sign of trouble.<\/p>\n All three have evidence of exploitation or exploit attempts in the wild. Honeypot telemetry, vendor advisories, and independent threat research each show active attacker interest, with the NetScaler flaw drawing fresh scanning activity in the days before the KEV<\/a> deadline.<\/p>\n