Act
active
Critical Citrix NetScaler auth bypass CVE-2026-19490 exploited in wild
- Engineer — Act: NetScaler is a widely deployed internet-facing edge appliance; a public PoC plus reported active exploitation makes patching urgent even absent a KEV listing — apply Citrix’s fix for CVE-2026-19490 immediately and audit NetScaler access logs for anomalous sessions since the PoC was published.
- SOC/IR — Act: Auth bypass on an edge device in active exploitation is assume-breach territory — sweep NetScaler access logs for unauthorized session establishment and anomalous management-plane activity dating back to when the public PoC dropped, and tune detections for post-auth lateral movement from NetScaler source IPs.
- Leader — Plan: Exploitation is reported by a single vendor source and EPSS remains low; confirm engineering has NetScaler patching on this week’s priority list and set a check-in to escalate if KEV listing or multi-source confirmation of widespread compromise emerges.
- Signals: CVE-2026-19490 — CISA KEV: not listed, EPSS 0.03, public PoC on GitHub
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.