Cloud Software Group has issued an urgent security bulletin for two high-severity vulnerabilities affecting NetScaler ADC and NetScaler Gateway appliances, formerly known as Citrix ADC and Citrix Gateway.
Tracked as CVE-2026-19489 and CVE-2026-19490, the flaws could enable denial-of-service attacks or authentication bypass on vulnerable internet-facing appliances.
The issues pose a significant risk to organizations that depend on NetScaler Gateway for remote access, VPN connectivity, and application delivery.
Critical Citrix NetScaler Authentication Bypass Flaw
The most severe issue, CVE-2026-19490, has received a CVSS v4.0 score of 9.3 and is categorized as CWE-288, Authentication Bypass Using an Alternate Path.
An unauthenticated attacker could bypass access controls on affected NetScaler deployments configured as a Gateway for SSL VPN, ICA Proxy, Clientless VPN, or RDP Proxy services. The issue also affects appliances operating an AAA virtual server.
Successful exploitation could allow a threat actor to gain unauthorized access to internal services without possessing valid credentials.
Since these appliances commonly sit at the edge of corporate networks and enforce authentication for remote users, compromise could provide attackers with a direct entry point into sensitive enterprise environments.
Exploitability depends on the software version and configuration. On NetScaler ADC and Gateway 14.1-43.56 and later, as well as 13.1-61.28 and later, CVE-2026-19490 is exploitable only when a SAML action configuration is present.
Earlier vulnerable builds have a substantially broader attack surface. Any Gateway or AAA virtual server configuration may be sufficient to expose the appliance to authentication-bypass attempts, even in deployments where SAML is not enabled.
The second vulnerability, CVE-2026-19489, carries a CVSS v4.0 score of 8.8. It is a memory overflow issue categorized under CWE-119, Improper Restriction of Operations within the Bounds of a Memory Buffer.
The flaw affects appliances where SIP ALG (Session Initiation Protocol Application Layer Gateway) is enabled in a Large Scale NAT group configuration. An attacker who meets the required conditions could trigger unpredictable behavior or force the appliance into a denial-of-service state.
A successful attack could interrupt NAT translation, traffic management, VPN availability, and other services routed through the affected NetScaler appliance.
For enterprises using NetScaler as a core networking component, an outage could disrupt remote access and business-critical communications.
Affected Versions and Fixes
The vulnerabilities affect NetScaler ADC and NetScaler Gateway versions 14.1 before build 73.32 and 13.1 before build 63.21, as well as the corresponding FIPS and NDcPP variants.
Secure Private Access Hybrid deployments that use customer-managed NetScaler instances are also exposed and require the same upgrades. Cloud-managed services and Adaptive Authentication offerings have already received patches.
Cloud Software Group recommends upgrading immediately to NetScaler ADC and Gateway 14.1-73.32 or later, 13.1-63.21 or later, or the applicable patched FIPS and NDcPP builds.
Administrators should review appliance configuration files while planning remediation. For CVE-2026-19489, teams should identify Large-Scale NAT group entries that contain SIP ALG settings.
For CVE-2026-19490, administrators should check for SAML actions, Gateway virtual servers, VPN virtual servers, and AAA virtual server configurations. The flaws were responsibly disclosed by Samarth Vashisht of JPMorgan Chase’s penetration-testing team.
Given NetScaler’s history as a frequent target for widespread scanning and exploitation, organizations should treat patching as an urgent security priority and monitor appliance and authentication logs for suspicious activity.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
