NetScaler auth bypass lands on exploited bugs list

Citrix customers have another NetScaler patch job on their hands.

In a primary security bulletin first published on 19 August 2026, Citrix and Cloud Software Group disclosed two critical vulnerabilities affecting customer-managed NetScaler ADC, formerly Citrix ADC, and NetScaler Gateway, formerly Citrix Gateway.

The higher-rated bug is CVE-2026-19490, an authentication bypass using an alternate path. Citrix gives it a CVSS v4.0 base score of 9.3. The second is CVE-2026-19489, a memory overflow issue that Citrix says can lead to unpredictable behaviour or denial of service. It carries a CVSS v4.0 base score of 8.8.

The practical message is simple: check your builds and upgrade if exposed.

Citrix says affected supported versions include NetScaler ADC and NetScaler Gateway 14.1 before 14.1-73.32, and 13.1 before 13.1-63.21. It also lists NetScaler ADC FIPS before 14.1-73.32 FIPS, plus NetScaler ADC FIPS and NDcPP before 13.1-37.277.

Secure Private Access Hybrid deployments using NetScaler instances are also affected, according to the vendor bulletin. Citrix says the advisory applies only to customer-managed NetScaler ADC and NetScaler Gateway. Cloud Software Group says it handles upgrades for Citrix-managed cloud services and Citrix-managed Adaptive Authentication.

The conditions matter. For CVE-2026-19489, Citrix says SIP ALG must be enabled on a Large Scale NAT group configuration. It advises customers to inspect configurations for the string “add lsn group.*sipalg.*”.

For CVE-2026-19490, the appliance must be configured as a Gateway, covering SSL VPN, ICA Proxy, CVPN or RDP Proxy, or as an AAA virtual server, with version-specific conditions. On some later builds, Citrix says the issue applies only when a SAML action is configured as well. Citrix advises checking for SAML action configuration, authentication virtual servers or VPN virtual servers.

There is no workaround listed in the Citrix bulletin. The vendor says affected customers should install the relevant updated versions “as soon as possible”.

A secondary government alert from the Canadian Centre for Cyber Security, dated 4 September 2026 and updated 9 September 2026, repeats the upgrade advice and adds an important escalation. The Cyber Centre says the US Cybersecurity and Infrastructure Security Agency added CVE-2026-19490 to its Known Exploited Vulnerabilities catalogue on 9 September 2026.

That does not, by itself, describe who is exploiting it or against which targets. But it does move the authentication bypass from theoretical risk to the kind of bug defenders are expected to treat as urgent.

Citrix credited Samarth Vashisht from the pen-test team at JPMorgan Chase for working with it to protect customers.