2026-010: Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway
Citrix patched NetScaler ADC/Gateway: auth bypass CVE-2026-19490 (CVSS 9.3) on Gateway/AAA configs and memory overflow CVE-2026-19489 (CVSS 8.8) requiring SIP ALG.
On 19 August 2026 Citrix published an advisory fixing two critical-severity issues in NetScaler ADC and NetScaler Gateway versions 14.1 before 14.1-73.32 and 13.1 before 13.1-63.21, plus FIPS/NDcPP builds. CVE-2026-19490 (CVSS 9.3) is an authentication bypass via alternate path, exploitable when the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, with a SAML action condition on newer builds. CVE-2026-19489 (CVSS 8.8) is a memory overflow causing unpredictable behaviour or denial of service, requiring SIP ALG enabled on a Large Scale NAT group. CERT-EU recommends applying updated builds as soon as possible.
- CVE-2026-19490 (CVSS 9.3): authentication bypass via alternate path on Gateway/AAA configurations
- CVE-2026-19489 (CVSS 8.8): memory overflow leading to DoS, requires SIP ALG on an LSN group
- Affected: NetScaler ADC/Gateway 14.1 < 14.1-73.32 and 13.1 < 13.1-63.21, plus FIPS builds
- SAML action configuration is a precondition for CVE-2026-19490 on builds 14.1-43.56+/13.1-61.28+
- Vendors
- Citrix
- Products
- NetScaler ADCNetScaler Gateway
- Organizations
- CERT-EU
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19489 | Unauthenticated Buffer Overflow in Citrix NetScaler ADC and NetScaler Gateway | 8.8 | <1% | ||
| CVE-2026-19490 | Remote Authentication Bypass in Citrix NetScaler ADC and NetScaler Gateway | 9.3 | 33% | KEVPoC | KEV |
From the original article
1 min read at cert.europa.eu
On 19 August 2026, Citrix published a security advisory addressing multiple critical vulnerabilities in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). CERT-EU recommends updating affected devices as soon as possible.
cert.europa.eu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.