Citrix Urges Admins to Patch Two NetScaler Vulnerabilities
Summary
Citrix urged admins to patch CVE-2026-19490, an authentication-bypass flaw, and CVE-2026-19489, a DoS flaw, in NetScaler ADC and Gateway. Both require specific configurations and are not known to be exploited; Citrix recommends firmware upgrades.
Key points
- CVE-2026-19490 may allow unauthenticated attackers to bypass authentication when specific NetScaler AAA or Gateway configurations and SAML settings are present.
- CVE-2026-19489 may enable denial-of-service attacks when SIP ALG is enabled in a large-scale NAT group configuration.
- Admins can check appliance configurations for the SAML, virtual server, and SIP ALG settings associated with the vulnerabilities.
- Citrix recommends upgrading affected appliances to specified supported NetScaler ADC and Gateway builds, including applicable FIPS and NDcPP builds.
- Citrix said the two flaws have not been flagged as exploited; the article notes that other NetScaler vulnerabilities were recently exploited and tracked by CISA.
Article Details
- Vulnerability Types
- Authentication bypass
- Memory overflow leading to denial of service
- Severity
- High
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
CVE-2026-19489to urgently secure NetScaler Gateway and NetScaler ADC appliances against CVE-2026-19490 and CVE-2026-19489, which can lead to authentication bypass and denial-of-service attacks under specific configurations.CVE-2026-19490Citrix has warned customers to urgently secure NetScaler Gateway and NetScaler ADC appliances against CVE-2026-19490 and CVE-2026-19489, which can lead to authentication bypass and denial-of-service attacks underCVE-2026-3055flagged as exploited in attacks, Citrix urged admins to patch two other NetScaler vulnerabilities (CVE-2026-3055 and CVE-2026-4368) on March 23, just days before attackers began abusing them in the wild.CVE-2026-4368in attacks, Citrix urged admins to patch two other NetScaler vulnerabilities (CVE-2026-3055 and CVE-2026-4368) on March 23, just days before attackers began abusing them in the wild.
Vendors
Products
NetScaler ADCCitrix has warned customers to urgently secure NetScaler Gateway and NetScaler ADC appliances against CVE-2026-19490 and CVE-2026-19489, which can lead to authentication bypass and denial-of-service attacks underNetScaler GatewayCitrix has warned customers to urgently secure NetScaler Gateway and NetScaler ADC appliances against CVE-2026-19490 and CVE-2026-19489, which can lead to authentication bypass and denial-of-service attacks underSecurAccess ZTNA HybridSecurAccess ZTNA Hybrid (formerly Secure Private Access Hybrid) deployments that use customer-managed NetScaler instances are also affected and should be upgraded to the recommended builds.”