Overview
- Citrix published a security advisory and released fixed NetScaler ADC and NetScaler Gateway builds on Wednesday to address two vulnerabilities and urged customers to upgrade affected, customer-managed appliances immediately.
- The most severe flaw, CVE-2026-19490, is an authentication bypass rated CVSS 9.3 that lets remote unauthenticated actors bypass login checks when appliances are configured as a Gateway or an AAA virtual server and when specific SAML action settings apply.
- The second flaw, CVE-2026-19489, is a memory overflow rated CVSS 8.8 that can cause unpredictable behavior or denial of service but only applies when SIP ALG is enabled on a Large Scale NAT (LSN) group.
- Citrix published exact fixed builds (for example 14.1-73.32 and 13.1-63.21), provided configuration checks administrators can run to see if preconditions are present, and said Global Deny Lists and signature rules can mitigate risk on supported firmware while patches are applied.
- Security firms note there are no confirmed in-the-wild exploits yet but expect rapid weaponization because NetScaler often faces the internet; organizations should prioritize emergency patching to avoid remote gateway compromise and downstream access to internal apps.