Critical NetScaler Vulnerability Allows Authentication Bypass

Citrix has released updates that address two vulnerabilities in customer-managed deployments of NetScaler ADC and NetScaler Gateway. The issues affect certain FIPS and NDcPP builds among others, as well as hybrid SecurAccess ZTNA deployments that rely on customer NetScaler instances. Citrix-managed cloud services and Adaptive Authentication are not affected — the necessary patches have already been applied there.

Two vulnerabilities

The first, CVE-2026-19489 (CVSS score 8.8), involves a memory overflow and can lead to unpredictable behavior or denial of service. However, it only manifests when SIP ALG is enabled in a Large Scale NAT (LSN) configuration.

The second, CVE-2026-19490 (CVSS 9.3), is more dangerous: it allows authentication to be bypassed on devices configured as a gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as a virtual AAA server. The conditions under which it triggers depend on the firmware version: newer builds require configured SAML authentication, while for older ones the gateway or AAA server role alone is enough.

What administrators should do

Citrix advises checking configurations against the described conditions and setting priorities based on the device's external exposure, its role, and whether the vulnerable setting is enabled. You can determine whether the preconditions are present by searching the configuration for characteristic strings — for example, add lsn group.*sipalg.* for the first vulnerability, and SAML action settings or AAA/VPN server settings for the second.

For CVE-2026-19490 there is also a workaround: when using NetScaler Console (cloud or on-premises) with firmware newer than 14.1-60.52 or 13.1-63.16, the Global Deny Lists feature works, automatically applying signatures to managed devices. It is enabled by default.

Fixes are available in versions 14.1-73.32, 13.1-63.21 and the corresponding FIPS and NDcPP builds. The vulnerabilities were discovered and reported by Samarth Vashisht of JPMorgan Chase's penetration testing team.

There are no signs of exploitation in real-world attacks yet, but fresh flaws in Citrix products have traditionally proven to be a tempting target. Last month, for instance, an insufficient input validation vulnerability in NetScaler (CVE-2026-8451, CVSS 8.8) began to be actively exploited less than a day after its public disclosure.

Source: The Hacker News