Citrix has issued an urgent advisory for customers to patch two critical vulnerabilities in its NetScaler ADC and NetScaler Gateway products, including a severe authentication bypass flaw identified as CVE-2026-19490. The company, through its parent Cloud Software Group, strongly recommends that users review the official security bulletin and upgrade affected appliances immediately.
The more critical of the two vulnerabilities, CVE-2026-19490, carries a CVSS v4.0 score of 9.3. This flaw allows an attacker to bypass login authentication checks through an alternate path, but only under specific configuration conditions. Affected appliances must be configured as a Gateway, supporting functions such as SSL VPN, ICA Proxy, CVPN, or RDP Proxy, or as an AAA virtual server. The vulnerability's exposure also depends on the firmware version and whether a SAML action is configured. For older firmware versions, the Gateway or AAA configuration alone is sufficient to meet the precondition, even without SAML being configured. The precise version thresholds vary between standard and FIPS builds.
Security teams can determine if their systems are exposed to CVE-2026-19490 by searching their NetScaler configuration for "add authentication samlAction" to identify SAML action setups, or for "add authentication vserver" and "add vpn vserver" to detect Auth or VPN virtual server configurations. As an alternative mitigation, if NetScaler Console (Service or on-prem) is in use and the NetScaler firmware version is 14.1-60.52 or 13.1-63.16 or higher, signatures can be applied. These versions include a "Global Deny Lists" feature that consumes and automatically applies signatures to NetScaler appliances managed via NetScaler Console.
The second vulnerability, CVE-2026-19489, is a memory overflow issue with a CVSS v4.0 score of 8.8. This flaw can lead to unpredictable behavior or a denial-of-service condition. Its applicability is also conditional, specifically when SIP ALG is enabled within a Large Scale NAT (LSN) group setup. To check for exposure to this second flaw, security teams should search their configuration for "add lsn group" combined with "sipalg."
The vulnerabilities affect several versions of NetScaler ADC and NetScaler Gateway:
NetScaler ADC and NetScaler Gateway 14.1 BEFORE 14.1-73.32
NetScaler ADC and NetScaler Gateway 13.1 BEFORE 13.1-63.21
NetScaler ADC FIPS BEFORE 14.1-73.32 FIPS
NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.277
Cloud Software Group's Senior VP of Engineering, Anil Shetty, confirmed that the bulletin applies to supported versions of customer-managed NetScaler ADC and NetScaler Gateway, including certain FIPS and NDcPP builds. SecurAccess ZTNA Hybrid (formerly Secure Private Access Hybrid) deployments that utilize customer-managed NetScaler instances are also affected and require upgrades to the recommended builds.
Citrix has noted a specific behavior change after upgrading an ICA proxy setup to version 14.1-72.16 (or 13.1-63.18) or later. Any ICA session attempting to reconnect using a session ticket issued by the older, pre-upgrade version will be dropped. Users will need to relaunch their sessions, which Citrix states is a security measure rather than an unintended side effect of the upgrade.
As of August 19, 2026, there have been no observed instances of exploitation for CVE-2026-19490. However, cybersecurity researchers are urging organizations to prioritize patching immediately, citing a historical trend of rapid exploitation of Citrix product vulnerabilities once they become public. At the time of Citrix’s advisory, the NetScaler images available on AWS, Azure, and GCP marketplaces had not yet been updated with the patched builds.
