Citrix Urges Urgent Patching for Critical NetScaler Authentication Bypass Vulnerability
Citrix has released patches for two critical vulnerabilities in its NetScaler ADC and Gateway products, including a severe authentication bypass flaw, CVE-2026-19490.
Citrix has issued an urgent call to action for its customers, urging them to immediately upgrade their NetScaler ADC and NetScaler Gateway appliances. The company has released patches for two significant vulnerabilities, with CVE-2026-19490 being a critical authentication bypass flaw that poses a severe risk to affected deployments.
Anil Shetty, senior VP of Engineering at Cloud Software Group, Citrix's parent company, emphasized the importance of applying these updates. "We strongly recommend that customers review the official NetScaler ADC and NetScaler Gateway security bulletin, assess whether their deployments are affected, and upgrade impacted appliances to the recommended builds as soon as possible," Shetty stated. The advisory applies to customer-managed NetScaler ADC and NetScaler Gateway, including specific FIPS and NDcPP builds, as well as SecurAccess ZTNA Hybrid deployments utilizing these customer-managed instances.
The critical CVE-2026-19490 vulnerability carries a CVSS v4.0 score of 9.3 and allows an attacker to bypass login mechanisms through an alternate path. However, its exploitation is contingent on specific configurations. The appliance must be set up as a Gateway (handling SSL VPN, ICA Proxy, CVPN, or RDP Proxy) or as an AAA virtual server. Furthermore, the vulnerability's exploitability is influenced by the firmware version and the presence of a SAML action configuration. Older firmware versions may be vulnerable with just the Gateway or AAA configuration, even without SAML.
To help customers identify their exposure, Citrix has provided guidance on checking their NetScaler configurations. Administrators can look for the presence of "add authentication samlAction" to detect SAML action setups, or "add authentication vserver" and "add vpn vserver" to identify Auth or VPN virtual servers. These checks will help determine if the preconditions for CVE-2026-19490 are met.
While Rapid7 reported no observed exploitation of CVE-2026-19490 as of August 19, 2026, the firm cautioned that Citrix products are often targeted rapidly once vulnerabilities become public. They strongly advised organizations to prioritize patching these affected systems on an emergency basis due to the potential for swift exploitation.
In addition to the authentication bypass, Citrix also addressed CVE-2026-19489, a memory overflow vulnerability with a CVSS v4.0 score of 8.8. This flaw can lead to unpredictable behavior or denial of service, but it is narrowly scoped, affecting only configurations where SIP ALG is enabled on a Large Scale NAT group. Exposure can be identified by searching for both "add lsn group" and "sipalg" in the NetScaler configuration.
The affected versions include NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.32, and 13.1 before 13.1-63.21. FIPS and NDcPP builds are also impacted, with specific version thresholds provided in the security bulletin. Citrix also noted that patched builds had not yet been refreshed on major cloud marketplaces like AWS, Azure, and GCP at the time of the advisory.
Citrix also clarified a security measure related to session reconnection after upgrades. Once a NetScaler in an ICA proxy setup is upgraded to version 14.1-72.16 or later, any ICA session attempting to reconnect with a ticket from an older version will be dropped, requiring users to re-launch their sessions. This is a deliberate security enhancement, not an unintended consequence of the upgrade.