[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGZRBAhV3cdMKLpJp6qzJ4lLBUNMcYMzdrWiFmUTIFd4":3},{"article":4,"iocs":50,"watch_terms":55,"solutions":56,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"df004bfb-5986-4065-9676-ec02a9f93598","Critical Citrix NetScaler auth bypass now leveraged in attacks","critical-citrix-netscaler-auth-bypass-now-leveraged-in-attacks-7483ae","Attackers have begun targeting a critical-severity Citrix NetScaler auth bypass flaw (CVE-2026-19490) in the wild, according to vulnerability intelligence company Previdian. [...]","Attackers have begun actively exploiting a critical authentication bypass vulnerability (CVE-2026-19490) in Citrix NetScaler appliances. The flaw allows unprivileged actors to bypass authentication remotely under specific configuration conditions. Security researchers and national cybersecurity centers are urging immediate patching due to evidence of exploitation attempts originating from Australia, the US, and Germany.","Attackers exploit critical Citrix NetScaler auth bypass flaw CVE-2026-19490 in the wild.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-target-critical-citrix-netscaler-auth-bypass-in-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F09\u002F04\u002FCitrix-headpic.jpg","2026-09-04T15:25:59+00:00","2026-09-04T16:00:27.409378+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"NetScaler","product",{"name":21,"type":22},"Citrix","vendor",{"name":24,"type":25},"SSL VPN","technology",{"name":27,"type":25},"ICA Proxy",{"name":29,"type":25},"CVPN",{"name":31,"type":25},"RDP Proxy","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,45],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51],{"type":52,"value":53,"context":54},"cve","CVE-2026-19490","Critical Citrix NetScaler authentication bypass vulnerability",[21,18],{"controls":57,"vendors":140},[58,87,112],{"slug":59,"name":60,"problem":61,"products":62},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":88,"name":89,"problem":90,"products":91},"patch-management","Automated patch management","Known holes get closed in days, not months.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":88,"product_name":109,"url":110,"description":111},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":49,"name":113,"problem":114,"products":115},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",[141],{"slug":142,"name":21,"logo_path":143,"roles":144},"citrix","\u002Fvendor-logos\u002Fcitrix.png",[145],"affected",{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":161},"citrix-netscaler-auth-bypass-actively-exploited-in-the-wild","Citrix NetScaler Auth Bypass Actively Exploited in the Wild","A critical authentication bypass vulnerability (CVE-2026-19490) in Citrix NetScaler appliances is now being actively exploited, allowing remote, unprivileged attackers to circumvent authentication controls under specific configuration conditions. This highlights the persistent danger of unpatched internet-facing network appliances, which serve as high-value entry points for threat actors. The exploitation activity spanning multiple continents underscores how quickly adversaries operationalize newly disclosed vulnerabilities, leaving organizations with a narrow window to respond. Delayed patching of perimeter devices like NetScaler — which often handle sensitive authentication flows — can result in full network compromise, credential theft, and lateral movement.",[151,152,153,154,155,156,157,158,159,160],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST CSF ID.VM-1: Asset Vulnerability Management","ITIL Change Management: Emergency Change Procedures","GDPR Article 32: Security of Processing (for EU-impacted organizations)",{}]