FHN 
Cloud Software Group has warned customers about two serious security vulnerabilities affecting NetScaler ADC and NetScaler Gateway, previously known as Citrix ADC and Citrix Gateway.
The vulnerabilities, tracked as CVE-2026-19489 and CVE-2026-19490, can cause service outages or allow attackers to bypass authentication on vulnerable systems.
Critical Authentication Bypass Vulnerability
The more serious issue, CVE-2026-19490, has a CVSS v4.0 score of 9.3.
The flaw can allow attackers to bypass authentication on NetScaler systems configured for services such as:
- SSL VPN
- ICA Proxy
- CVPN
- RDP Proxy
- AAA virtual servers
A successful attack could give an unauthorized user access to corporate resources without legitimate credentials.
The affected configuration depends on the NetScaler version. Newer builds require specific SAML configurations for exploitation, while older versions may be vulnerable when Gateway or AAA virtual servers are configured.
Second Flaw Can Cause Service Disruption
The second vulnerability, CVE-2026-19489, has a CVSS v4.0 score of 8.8.
It is related to improper memory handling and can affect systems where SIP ALG is enabled within an LSN group configuration.
Successful exploitation could cause the appliance to behave unexpectedly or become unavailable, potentially interrupting services that rely on NetScaler for traffic management and NAT operations.
Which Versions Are Affected?
The vulnerabilities affect:
- NetScaler ADC and Gateway 14.1 before 73.32
- NetScaler ADC and Gateway 13.1 before 63.21
- Corresponding FIPS and NDcPP releases
Customer-managed NetScaler appliances used with Secure Private Access Hybrid deployments are also affected.
Cloud Software Group has already addressed the vulnerabilities in its cloud-managed services.
How to Check Your Exposure
Administrators should review their NetScaler configurations to determine whether the vulnerable features are enabled.
For CVE-2026-19489, check for LSN group configurations using SIP ALG.
For CVE-2026-19490, review SAML actions along with Gateway and AAA virtual server configurations.
This can help security teams identify vulnerable appliances before applying the required updates.
Recommended Action
Cloud Software Group recommends upgrading affected systems to:
NetScaler ADC and Gateway 14.1-73.32 or later
or
13.1-63.21 or later
Organizations should also apply the corresponding updates for FIPS and NDcPP versions where applicable.
Because NetScaler appliances commonly provide internet-facing remote access, these vulnerabilities should be treated as a high-priority security issue rather than a routine patching task.
Why Organizations Should Act Quickly
Authentication gateways are often a critical entry point into enterprise environments. A vulnerability that allows authentication controls to be bypassed can potentially give attackers access to sensitive corporate resources.
Security teams should therefore identify exposed appliances, apply the recommended updates, restrict unnecessary access, and monitor for unusual authentication or network activity.
The vulnerabilities were responsibly reported by Samarth Vashisht from JPMorgan Chase’s penetration testing team, highlighting the importance of security research in identifying weaknesses in widely deployed enterprise infrastructure.
Organizations running affected NetScaler versions should prioritize remediation before attackers begin actively targeting vulnerable systems.
About the Author
