"Customers should also review their configurations to determine whether the documented preconditions apply," Citrix said.
CVE-2026-19490: authentication bypass affecting Gateway and AAA vservers
Citrix disclosed a critical authentication bypass vulnerability tracked as CVE-2026-19490 with a CVSS score of 9.3. According to the advisory, the flaw affects appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server when specific version- and configuration-dependent preconditions are met. The company warned that prioritization should be based on "exposure, deployment role, and whether the affected configuration is enabled."
- 14.1-43.56 or later — Applicable only when configured with a SAML action AND NetScaler is configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver
- 14.1-66.68-FIPS or later — Applicable only when configured with a SAML action AND NetScaler is configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver
- 14.1-43.55 or earlier — Applicable when configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy ) or AAA vserver
- 13.1-61.28 or later — Applicable only when configured with a SAML action
- 13.1-61.27 or earlier — Applicable when configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver
- 13.1 FIPS — Applicable when configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver
CVE-2026-19489: SIP ALG memory overflow on LSN groups
The advisory also describes CVE-2026-19489 (CVSS 8.8), a memory overflow vulnerability that can cause unpredictable behavior or denial-of-service. Citrix states this issue applies only when Session Initiation Protocol Application Layer Gateway (SIP ALG) is enabled on a Large Scale NAT (LSN) group configuration, narrowing the set of deployments that are exposed.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogImpacted NetScaler versions and available updates
Citrix listed the affected builds and the updated releases that resolve both vulnerabilities. The affected lines include customer-managed NetScaler ADC and NetScaler Gateway, certain FIPS and NDcPP builds, and SecurAccess ZTNA Hybrid deployments that use customer-managed NetScaler instances. Citrix emphasized that Citrix-managed cloud services and Citrix-managed Adaptive Authentication are not impacted because the updates have already been applied.
- Impacted versions (summary):
- NetScaler ADC and NetScaler Gateway 14.1 BEFORE 14.1-73.32
- NetScaler ADC and NetScaler Gateway 13.1 BEFORE 13.1-63.21
- NetScaler ADC FIPS BEFORE 14.1-73.32 FIPS
- NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.277
- Fixed versions:
- NetScaler ADC and NetScaler Gateway 14.1-73.32 or later
- NetScaler ADC and NetScaler Gateway 13.1-63.21 or later
- NetScaler ADC FIPS 14.1-73.32 FIPS or later
- NetScaler ADC FIPS and NDcPP 13.1-37.277 or later
Mitigation: configuration checks and Global Deny Lists
Citrix provided explicit configuration checks administrators can run to determine whether a device meets the preconditions for each flaw. For CVE-2026-19489, customers can inspect their NetScaler configuration for the string:
- add lsn group.*sipalg.*
For CVE-2026-19490, Citrix recommended checking for:
- add authentication samlAction.* (SAML action configuration)
- add authentication vserver .* or add vpn vserver .* (for AAA or VPN vserver)
Citrix also described a mitigation for customers using NetScaler Console (Service or on-prem). If the NetScaler firmware version is higher than 14.1-60.52 or 13.1-63.16, the product includes a feature called Global Deny Lists that consumes and automatically applies signatures to managed NetScaler appliances. Citrix said the feature is enabled by default.
What this means for security teams, Citrix-managed cloud customers, and attackers
Security teams: Citrix advised teams to "review their configurations to determine whether the documented preconditions apply" and to prioritize remediation by exposure and deployment role. The advisory includes precise configuration strings to search for, allowing rapid triage.
Citrix-managed cloud customers: These customers are not affected; Citrix stated the necessary updates have already been applied to Citrix-managed cloud services and to Citrix-managed Adaptive Authentication.
Attackers and defenders: Citrix noted that "newly disclosed Citrix vulnerabilities have been a lucrative target for attackers." The advisory also referenced a recent example: last month an insufficient input validation vulnerability in NetScaler ADC and NetScaler Gateway (CVE-2026-8451, CVSS score: 8.8) "witnessed active exploitation efforts less than 24 hours of public disclosure."
Citrix credited Samarth Vashisht from the pen-test team at JPMorgan Chase for discovering and reporting the flaws. Although Citrix reported no evidence of exploitation for these two new issues, the company’s guidance and the included configuration checks give administrators concrete steps to determine exposure and to apply the listed fixes or mitigations.
