GoKawiilCitrix has warned customers to immediately secure their systems against two vulnerabilities affecting NetScaler Gateway secure remote access solutions and NetScaler ADC networking appliances.
The most severe of the two, tracked as CVE-2026-19490, can allow remote attackers without privileges to bypass authentication when the appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy), depending on the NetScaler firmware version and whether SAML Action is configured.
Admins can check if an appliance is vulnerable to attacks targeting CVE-2026-19490 by inspecting their NetScaler configuration for SAML action configuration (add authentication samlAction .*) string and Auth or VPN vserver ('add authentication vserver .*' and 'add vpn vserver .*') strings.
The second, a high-severity memory overflow security flaw tracked as CVE-2026-19489, can be abused by remote unauthenticated threat actors in denial-of-service (DoS) attacks when SIP ALG (Session Initiation Protocol Application Layer Gateway) is enabled on a large-scale NAT group configuration.
Security teams can determine whether Citrix NetScaler appliances on their network meet the preconditions for CVE-2026-19489 exploitation by inspecting their configuration for the "add lsn group.*sipalg.*" string.
Citrix advised customers to upgrade vulnerable NetScaler ADC and NetScaler Gateway appliances to:
NetScaler ADC and NetScaler Gateway 14.1-73.32 or later,
NetScaler ADC and NetScaler Gateway 13.1-63.21 or later,
NetScaler ADC FIPS 14.1-73.32 FIPS or later,
or NetScaler ADC FIPS and NDcPP 13.1-37.277 or later, as applicable
... continue reading