Citrix has issued an urgent advisory to customers, recommending immediate action to secure systems against two newly disclosed vulnerabilities impacting NetScaler Gateway secure remote access solutions and NetScaler ADC networking appliances. The company confirmed these flaws affect supported versions of customer-managed NetScaler ADC and NetScaler Gateway, including specific FIPS and NDcPP builds, as well as SecurAccess ZTNA Hybrid deployments utilizing customer-managed NetScaler instances.
The more critical of the two, identified as CVE-2026-19490, is an authentication bypass vulnerability. This flaw could allow unprivileged remote attackers to bypass authentication when the appliance is configured as an AAA virtual server or a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy). The exploitability of this vulnerability depends on the NetScaler firmware version and whether SAML Action is configured. Administrators can check for vulnerability by searching their NetScaler configuration for the "add authentication samlAction .*" string and either "add authentication vserver .*" or "add vpn vserver .*" strings.
The second vulnerability, CVE-2026-19489, is a high-severity memory overflow flaw. This issue could be exploited by unauthenticated remote threat actors to launch denial-of-service (DoS) attacks. Exploitation is possible when the Session Initiation Protocol Application Layer Gateway (SIP ALG) is enabled within a large-scale NAT group configuration. To determine if an appliance is susceptible, security teams should inspect their configuration for the "add lsn group.*sipalg.*" string.
Citrix has provided specific upgrade paths to address these vulnerabilities. Affected customers are advised to update their NetScaler ADC and NetScaler Gateway appliances to NetScaler ADC and NetScaler Gateway 14.1-73.32 or later, or 13.1-63.21 or later. For FIPS and NDcPP builds, the recommended versions are NetScaler ADC FIPS 14.1-73.32 FIPS or later, or NetScaler ADC FIPS and NDcPP 13.1-37.277 or later.
While Citrix has not yet observed active exploitation of CVE-2026-19490 and CVE-2026-19489, the company emphasized the importance of prompt patching. This caution follows a previous incident in March where Citrix urged patching for CVE-2026-3055 and CVE-2026-4368, only for attackers to begin exploiting them in the wild days later. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) subsequently added CVE-2026-3055 to its Known Exploited Vulnerabilities (KEV) Catalog, mandating federal agencies to secure vulnerable Citrix appliances within three days.
Over the past five years, CISA has identified 22 Citrix vulnerabilities as actively exploited, with six of these also being leveraged in ransomware attacks. Current data from the ShadowServer Foundation indicates over 22,000 NetScaler ADC instances and nearly 1,800 NetScaler Gateway instances are publicly exposed online, though specific vulnerability counts for the newly disclosed flaws are not available.
