Summary
Security firm Previdian reported that on 3 September 2026 one of its NetScaler sensors received requests matching public proof-of-concept code from three distinct source IPs geolocated to Australia, the United States and Germany. CVE-2026-19490 permits unprivileged remote attackers to bypass authentication on NetScaler ADC and Gateway appliances configured as AAA virtual servers or gateways, depending on firmware version and SAML Action configuration. Belgium's National Cybersecurity Coordination Centre issued a parallel warning, and more than 22,000 NetScaler ADC appliances are tracked as internet-exposed. Citrix released fixed builds in mid-August 2026.
Sources
Attribution
Unattributed
Where
Australia
Also: United States, Germany, Belgium
Sectors: Government, Financial Services, Healthcare, Technology
EU relevance
High
Also affected EU member states (Belgium, Germany)
Graded by rules: EU member states affected, EU response, EU sanctions, EU projects in the sector hit.