Citrix has issued an urgent advisory warning customers to patch two newly disclosed vulnerabilities affecting NetScaler ADC and NetScaler Gateway appliances. The most severe vulnerability, CVE-2026-19490, enables unauthenticated authentication bypass under specific configurations, potentially allowing remote attackers to gain unauthorized access to exposed services. A second vulnerability, CVE-2026-19489, could enable unauthenticated attackers to trigger denial-of-service (DoS) conditions.
Although Citrix has not reported active exploitation at the time of publication, the vendor is strongly recommending immediate remediation. This warning is particularly significant given the history of NetScaler vulnerabilities being weaponised shortly after disclosure.
Severity: High
Description: A memory overflow vulnerability affecting appliances where SIP ALG (Session Initiation Protocol Application Layer Gateway) is enabled within large-scale NAT group configurations. The flaw can be abused remotely without authentication to trigger denial-of-service conditions.
Potential Impact:
Severity: Critical
Description: An authentication bypass vulnerability affecting NetScaler deployments configured as:
The vulnerability may allow a remote, unauthenticated attacker to bypass authentication controls depending on firmware version and SAML configuration.
Potential Impact:
Affected Products
Citrix states the vulnerabilities affect supported versions of:
Recommended Remediation
Citrix recommends upgrading affected appliances to the following builds or later:
Administrators should review NetScaler configurations to determine exposure:
For CVE-2026-19490
For CVE-2026-19489
If you are worried about any of the threats outlined in this bulletin or need help in determining what steps you should take to protect yourself from the most material threats facing your organisation, please contact your account manager, or alternatively get in touch to find out how you can protect your organisation.