Do Son 
TL;DR
Citrix patched a critical NetScaler authentication bypass tracked as CVE-2026-19490. It scores 9.3 on CVSS v4. A second flaw, CVE-2026-19489, can cause denial of service.
- Product: NetScaler ADC
- Vulnerabilities: 2 flaws (CVE-2026-19490, CVE-2026-19489)
- Highest severity: 9.3 (Critical · CVSSv4)
- Worst impact: and Gateway Security Bulletin for CVE-2026-19490
- Status: No confirmed exploitation yet
- Action: See vendor advisories
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-19490 | 9.3 | and Gateway Security Bulletin for CVE-2026-19490 | — | Not exploited |
| CVE-2026-19489 | 8.8 | Awaiting analysis | — | Not exploited |
Why it matters
NetScaler appliances sit at the edge of many corporate networks. They handle VPN and single sign-on for remote staff. A NetScaler authentication bypass therefore hands attackers a direct route inside.
Cloud Software Group rated the bulletin critical. The company urges customers to patch without delay. NetScaler flaws draw active interest, since earlier bugs like CitrixBleed saw fast exploitation after disclosure.
How the attack works
CVE-2026-19490 is an authentication bypass using an alternate path. The advisory classifies it under CWE-288. In short, an attacker reaches a protected function through an unexpected route.
The flaw scores high across confidentiality, integrity, and availability. It needs no privileges and no user interaction. Only appliances in specific roles are exposed.
The second bug, CVE-2026-19489, is a memory overflow. It can trigger unpredictable behavior or denial of service. That flaw only affects SIP ALG on a Large Scale NAT group.
Affected versions
The bypass hits NetScaler configured as a Gateway or AAA virtual server. Vulnerable branches include 14.1 before 14.1-73.32 and 13.1 before 13.1-63.21. FIPS and NDcPP builds are also affected.
Newer builds are exposed only when a SAML action is configured. The bulletin applies only to customer-managed appliances. Cloud-managed services are patched by the vendor.
Patch and mitigation
Update now. Fixed releases include 14.1-73.32, 13.1-63.21, and the matching FIPS builds.
Cloud Software Group “strongly urges affected customers” to install the updates as soon as possible. There are no workarounds. No exploitation in the wild has been confirmed for these two flaws.
The company credited Samarth Vashisht of the JPMorgan Chase pen-test team for the report. Admins can check their configuration to confirm whether an appliance meets the vulnerable preconditions.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
