Citrix Warns 2 NetScaler Flaws Could Bypass Auth and Trigger DoS
Updated
Updated · BleepingComputer · Aug 20
Citrix Warns 2 NetScaler Flaws Could Bypass Auth and Trigger DoS
3 articles · Updated · BleepingComputer · Aug 20
Summary
Citrix urged customers to upgrade NetScaler ADC and Gateway appliances immediately after disclosing CVE-2026-19490, a critical authentication-bypass flaw, and CVE-2026-19489, a high-severity memory overflow bug.
CVE-2026-19490 can let unauthenticated attackers access systems when NetScaler is configured as an AAA virtual server or Gateway with SAML action enabled, while CVE-2026-19489 can be used for denial-of-service attacks when SIP ALG is enabled on large-scale NAT groups.
Affected customers should move to 14.1-73.32 or 13.1-63.21 and corresponding FIPS or NDcPP builds; SecurAccess ZTNA Hybrid deployments using customer-managed NetScaler instances are also affected.
The flaws are not yet flagged as exploited, but Citrix noted attackers started abusing two other NetScaler bugs days after a March warning; CISA later added one of them to its exploited-vulnerabilities catalog.
ShadowServer tracks more than 22,000 internet-exposed NetScaler ADC instances and nearly 1,800 NetScaler Gateway systems, underscoring the potential attack surface if unpatched.