Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490)

Citrix has patched two vulnerabilities in NetScaler ADC and NetScaler Gateway, including a critical authentication bypass flaw tracked as CVE-2026-19490, and is urging customers to upgrade affected appliances as soon as possible.

“We strongly recommend that customers review the official NetScaler ADC and NetScaler Gateway security bulletin, assess whether their deployments are affected, and upgrade impacted appliances to the recommended builds as soon as possible,” Anil Shetty, senior VP of Engineering with Cloud Software Group (Citrix’s parent company), warned on Wednesday.

“The bulletin applies to supported versions of customer-managed NetScaler ADC and NetScaler Gateway, including certain FIPS and NDcPP builds. SecurAccess ZTNA Hybrid (formerly Secure Private Access Hybrid) deployments that use customer-managed NetScaler instances are also affected and should be upgraded to the recommended builds,” added Shetty.

Rapid7 said it had not observed exploitation of CVE-2026-19490 as of August 19, 2026, but urged organizations to “prioritize patching affected systems on an emergency basis,” since Citrix products tend to draw quick exploitation once flaws become public.

The vulnerabilities (CVE-2026-19489, CVE-2026-19490)

CVE-2026-19490 is the more concerning of the two, with a CVSS v4.0 score of 9.3. It allows an attacker to bypass login checks using an alternate path, but only under specific conditions. The appliance has to be configured as a Gateway, covering SSL VPN, ICA Proxy, CVPN, or RDP Proxy, or as an AAA virtual server.

Whether it is exposed also depends on the firmware version and whether a SAML action is configured. On older firmware, the Gateway or AAA configuration alone is enough to meet the precondition, without SAML being configured. The exact version thresholds differ between standard and FIPS builds.

Security teams can check whether they meet the precondition by searching their NetScaler configuration for “add authentication samlAction” to spot a SAML action setup, or for “add authentication vserver” and “add vpn vserver” to spot an Auth or VPN virtual server.

“Additionally, this vulnerability can be mitigated by using signatures if you are using NetScaler Console (Service or on-prem) and if the NetScaler firmware version is higher than 14.1-60.52 and 13.1-63.16 or higher which have a feature called Global Deny Lists which consumes the signatures and automatically applies the signatures to NetScaler appliances managed via NetScaler Console,” noted Shetty.

The second flaw, CVE-2026-19489, is a memory overflow issue with a CVSS v4.0 score of 8.8 that can cause unpredictable behavior or denial of service. It only applies when SIP ALG is enabled on a Large Scale NAT group setup, another narrow precondition.

Security teams can check exposure to the second flaw by searching their configuration for “add lsn group” combined with “sipalg”.

The vulnerabilities affect:

• NetScaler ADC and NetScaler Gateway 14.1 BEFORE 14.1-73.32
• NetScaler ADC and NetScaler Gateway 13.1 BEFORE 13.1-63.21
• NetScaler ADC FIPS BEFORE 14.1-73.32 FIPS
• NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.277

“Once you upgrade a NetScaler in an ICA proxy setup to version 14.1-72.16 (or 13.1-63.18) or later, any ICA session that attempts to reconnect using a session ticket issued by the older (pre-upgrade) version is dropped. As a result, users must launch the session again. This is a security measure and not an after effect of upgrade activity,” Shetty explained.

At the time of Citrix’s advisory, the NetScaler images listed on AWS, Azure, and GCP marketplaces had not been refreshed with the patched builds.