Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitycritical

Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490)

Help Net Securityby @helpnetsecurity ()2 min read4
Read at helpnetsecurity.com
AI summary · glm-5.3-flashSummaries by Vani AI

Citrix patched a critical authentication bypass, CVE-2026-19490, in NetScaler Gateway and NetScaler ADC, urging customers to upgrade immediately.

Citrix has patched two flaws in NetScaler ADC and NetScaler Gateway. CVE-2026-19490 is a critical authentication bypass (CVSS v4.0 9.3) that works when the appliance is configured as an SSL VPN, ICA Proxy, CVPN, RDP Proxy Gateway or AAA virtual server, with additional conditions depending on firmware and SAML configuration. A second flaw, CVE-2026-19489 (CVSS 8.8), is a memory overflow that can cause denial of service when SIP ALG is enabled on LSN setups. Rapid7 had not observed exploitation as of August 19, 2026, but urged emergency patching; a signature-based mitigation is available via NetScaler Console.

Key facts
  • CVE-2026-19490 is a critical authentication bypass with CVSS v4.0 score 9.3
  • Affects NetScaler ADC and Gateway 14.1 and 13.1 builds, including FIPS and NDcPP
  • CVE-2026-19489 is a memory overflow (CVSS 8.8) causing DoS when SIP ALG is enabled
  • No exploitation observed as of August 19, 2026 per Rapid7
  • Signature mitigation available via NetScaler Console Global Deny Lists
Analyze CVE-2026-19490 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-19490CVE-2026-19489
ATT&CK
T1190 Exploit Public-Facing Application
Tags
authentication-bypasscitrixnetscalerpatchingrapid7
Vendors
CitrixRapid7Cloud Software Group
Products
NetScaler ADCNetScaler GatewayNetScaler Console

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-19489
Unauthenticated Buffer Overflow in Citrix NetScaler ADC and NetScaler Gateway
8.8<1%
CVE-2026-19490
Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway
9.333%KEVPoC
KEV

From the original article

2 min read at helpnetsecurity.com

Citrix has patched two vulnerabilities in NetScaler ADC and NetScaler Gateway, including a critical authentication bypass flaw tracked as CVE-2026-19490, and is urging customers to upgrade affected appliances as soon as possible.

Help Net Security

By @helpnetsecurity · helpnetsecurity.com

Read the full article at Help Net Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.