Organization

JPMorgan Chase

0 mentions in 7 days · 1 in 30 days · 1 total · first seen Sep 4, 2026 · last 11d ago

Timeline1 articles

Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers

Citrix patches critical NetScaler Gateway and AAA authentication bypass CVE-2026-19490 (CVSS 9.3) plus a SIP ALG memory overflow flaw; exploitation attempts observed.

Citrix fixed CVE-2026-19490 (CVSS 9.3), an authentication bypass affecting customer-managed NetScaler ADC and Gateway appliances configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual servers, and CVE-2026-19489 (CVSS 8.8), a memory overflow causing DoS when SIP ALG is enabled in Large Scale NAT groups. Updates are available in versions 14.1-73.32, 13.1-63.21, and corresponding FIPS/NDcPP builds, while Citrix-managed cloud services were already patched. The flaws were reported by Samarth Vashisht of JPMorgan Chase's penetration-testing team, and Previdian later observed 10 exploitation attempts against CVE-2026-19490 from six unique IP addresses in Australia, Germany, Japan, and the US, with no confirmed compromise.

The Hacker NewsSep 4, 17:00 UTC · 11d agoVulnerability in the wildCVE-2026-19489 CVE-2026-19490 CVE-2026-8451

Related CVEsby mentions

CVE-2026-194909.36%
Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway
Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability (CWE-288, 'using an alternate path or channel') that an unauthenticated remote threat actor can exploit. The flaw is triggerable when the appliance is configured as an AAA virtual server or as a Gateway, including SSL VPN, ICA Proxy, CVPN, or RDP Proxy deployments, allowing the attacker to bypass authentication without valid credentials. A successful bypass could give an attacker access to VPN-protected or AAA-gated resources as an authenticated user; no CVSS score has been published yet. Organizations running affected NetScaler appliances in these configurations are exposed, and affected version ranges are not specified in the available data, so defenders should consult Citrix advisory AL26-019. The flaw was added to CISA's KEV on 2026-09-09, indicating exploitation in the wild; ransomware use is unknown, no public PoC is known, and EPSS assigns a 3.4% probability of exploitation within 30 days (88th percentile).
· Citrix NetScaler ADC and NetScaler Gateway KEV PoC large
CVE-2026-84518.816%
Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML ID
Insufficient input validation in NetScaler ADC and NetScaler Gateway leading to memory overread if NetScaler ADC or NetScaler Gateway is configured as a SAML IDP
· citrix netscaler application delivery controller · citrix netscaler gateway—
CVE-2026-194898.8<1%
Unauthenticated Buffer Overflow in Citrix NetScaler ADC and NetScaler Gateway
CVE-2026-19489 is a vulnerability in Citrix NetScaler ADC and NetScaler Gateway classified as a classic buffer overflow (CWE-120), meaning input is copied into a buffer without adequate size checks; it was disclosed by Citrix alongside CVE-2026-19490, the authentication bypass receiving most of the headline attention. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), the flaw is reachable over the network by an unauthenticated remote attacker with no user interaction, though detailed trigger conditions are not spelled out in the CVE description. The scoring (VC:L/VI:L/VA:H, base 8.8 High) indicates the primary impact is to availability — likely crashes or denial of service on the appliance — with low confidentiality and integrity impact. All organizations running NetScaler ADC or NetScaler Gateway 14.1 releases through build 73.32, or 13.1 releases through build 63.21, fall within the affected ranges. There is no evidence of exploitation so far: the issue is not in CISA KEV, has no known public proof-of-concept, and EPSS estimates only a 0.4% probability of exploitation in the next 30 days (32nd percentile).
· Citrix NetScaler ADC (formerly Citrix ADC) 14.1 releases through build 73.32; 13.1 releases through build 63.21 · Citrix NetScaler Gateway (formerly Citrix Gateway) 14.1 releases through build 73.32; 13.1 releases through build 63.21mass

Appears with

organization Previdian 1 product NetScaler ADC 1 product NetScaler Console 1 product NetScaler Gateway 1 product SecurAccess ZTNA 1 vendor Citrix 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.