Citrix is urging customers to immediately secure their systems against two vulnerabilities affecting NetScaler Gateway, the company’s secure remote access solution, and NetScaler ADC, its application delivery and networking appliance.
The more serious of the two flaws is tracked as CVE-2026-19490. Depending on the NetScaler firmware version and whether SAML actions are configured, an unauthenticated or unprivileged remote attacker may be able to bypass authentication when the appliance is configured as a AAA virtual server or gateway, including SSL VPN, ICA Proxy, CVPN, or RDP Proxy deployments.
Administrators can check whether their NetScaler appliance may be vulnerable to attacks targeting CVE-2026-19490 by reviewing the SAML action and authentication virtual server configuration. Relevant configuration strings include add authentication samlAction .*, add authentication vserver .*, and add VPN vserver .*.
The second vulnerability, CVE-2026-19489, is a high-severity memory overflow flaw. When SIP ALG (Session Initiation Protocol Application Layer Gateway) is enabled in a large NAT group configuration, a remote, unauthenticated attacker may exploit the vulnerability to cause a denial-of-service (DoS) condition.
Security teams can determine whether their Citrix NetScaler appliances meet the conditions required for CVE-2026-19489 exploitation by checking for the add lsn group.*sipalg.* configuration string.
Citrix recommends that customers upgrade vulnerable NetScaler ADC and NetScaler Gateway appliances to one of the following builds:
- NetScaler ADC and NetScaler Gateway 14.1-73.32 or later;
- NetScaler ADC and NetScaler Gateway 13.1-63.21 or later;
- NetScaler ADC FIPS 14.1-73.32 FIPS or later; or
- NetScaler ADC FIPS and NDcPP 13.1-37.277 or later, where applicable.
“For our customers, please assess whether your deployment is affected and upgrade affected appliances to the recommended build as soon as possible,” Citrix said in its official security bulletin for NetScaler ADC and NetScaler Gateway and a security advisory published Wednesday.
“This information applies to supported versions of customer-managed NetScaler ADC and NetScaler Gateway, including certain FIPS and NDcPP builds. SecurAccess ZTNA Hybrid, formerly Secure Private Access Hybrid, deployments that use customer-managed NetScaler instances are also affected and should be upgraded to the recommended build.”
While Citrix has not reported exploitation of CVE-2026-19489 or CVE-2026-19490, the company has previously warned customers about two other NetScaler vulnerabilities, CVE-2026-3055 and CVE-2026-4368. Those warnings were issued on March 23, shortly before attackers began exploiting the flaws in the wild.
On March 30, CISA added CVE-2026-3055 to its Known Exploited Vulnerabilities (KEV) Catalog and directed federal agencies to secure affected Citrix appliances within three days.
Over the past five years, the U.S. Cybersecurity and Infrastructure Security Agency has listed 22 Citrix vulnerabilities. Six of those vulnerabilities have been exploited in the wild, including in ransomware attacks.
The Shadowserver Foundation currently tracks more than 22,000 NetScaler ADC appliances and approximately 1,800 NetScaler Gateway instances exposed to the internet. However, the data does not indicate how many of those systems are honeypots or whether they are vulnerable to attacks targeting CVE-2026-19489 and CVE-2026-19490.
The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.
Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.
Source: www.bleepingcomputer.com