"We strongly recommend that customers review the official NetScaler ADC and NetScaler Gateway security bulletin, assess whether their deployments are affected, and upgrade impacted appliances to the recommended builds as soon as possible," Citrix warned on Wednesday.
CVE-2026-19490: an authentication bypass that depends on SAML action and vserver role
Citrix has disclosed CVE-2026-19490, a vulnerability that can allow remote attackers without privileges to bypass authentication when a NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy). Whether the bypass is possible depends on the NetScaler firmware version and whether SAML Action is configured.
Administrators can check their NetScaler configuration for signs that an appliance meets the preconditions for this exploit by searching for the SAML action and authentication/vpn vserver configuration strings. The exact configuration strings Citrix named are: add authentication samlAction .*, add authentication vserver .*, and add vpn vserver .*.
CVE-2026-19489: SIP ALG memory overflow and DoS on large-scale NAT
The second issue, CVE-2026-19489, is a high-severity memory overflow security flaw that can be abused by remote unauthenticated actors to cause denial-of-service (DoS) when SIP ALG (Session Initiation Protocol Application Layer Gateway) is enabled on a large-scale NAT group configuration.
To determine whether an appliance meets the preconditions for exploitation, Citrix said security teams can inspect NetScaler configurations for the string: add lsn group.*sipalg.*. If that pattern appears, the appliance may be at risk from attacks exploiting CVE-2026-19489.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogWhich firmware builds Citrix recommends upgrading to
Citrix provided specific upgrade targets. Affected customers should move to one of the recommended builds, as applicable for their deployment:
- NetScaler ADC and NetScaler Gateway 14.1-73.32 or later
- NetScaler ADC and NetScaler Gateway 13.1-63.21 or later
- NetScaler ADC FIPS 14.1-73.32 FIPS or later
- NetScaler ADC FIPS and NDcPP 13.1-37.277 or later
Citrix said the bulletin applies to supported versions of customer-managed NetScaler ADC and NetScaler Gateway, including certain FIPS and NDcPP builds. It also noted that SecurAccess ZTNA Hybrid (formerly Secure Private Access Hybrid) deployments that use customer-managed NetScaler instances are affected and should be upgraded to the recommended builds.
Historical context: prior Citrix advisories, CISA action, and internet exposure
Citrix cautioned that, while these two flaws have not been flagged as exploited in attacks, customers should act quickly because of a recent pattern: the vendor urged admins to patch CVE-2026-3055 and CVE-2026-4368 on March 23 — just days before attackers began abusing those flaws in the wild.
Following that earlier activity, CISA added CVE-2026-3055 to its Known Exploited Vulnerabilities (KEV) Catalog on March 30 and ordered federal agencies to secure vulnerable Citrix appliances within three days. Over the last five years, CISA has flagged 22 Citrix vulnerabilities as exploited in the wild, six of them also abused in ransomware attacks.
On the exposure side, the ShadowServer Foundation now tracks over 22,000 NetScaler ADC and nearly 1,800 NetScaler Gateway instances exposed online, though it does not provide counts of how many are honeypots or how many meet the specific preconditions for CVE-2026-19489 and CVE-2026-19490 exploitation.
What this means for technologists and security teams, federal agencies, and procurement leaders
- Technologists and security teams: scan configurations for the exact strings Citrix listed (add authentication samlAction .*, add authentication vserver .*, add vpn vserver .*, and add lsn group.*sipalg.*) and prioritize upgrades to the specified builds.
- Federal agencies and regulators: the prior CISA action on CVE-2026-3055 shows rapid regulatory escalation is possible; agencies will watch for inclusion in the KEV Catalog and any short remediation timelines modeled on the March 30 order that required fixes within three days.
- Procurement and enterprise leaders: SecurAccess ZTNA Hybrid deployments that rely on customer-managed NetScaler instances are explicitly affected — those teams should ensure upgrade windows and vendor coordination cover these hybrid deployments.
Citrix's bulletin and the upgrade recommendations leave little ambiguity: inspect configurations for the named strings and move affected appliances to the listed builds without delay. The vendor's recent patch guidance followed by exploitation of other NetScaler flaws within days underscores the tight window between disclosure and active abuse. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply — a reminder that patching and configuration checks remain necessary but not sufficient parts of defense-in-depth.
