Full Report
AL26-019 - Vulnerabilities impacting Citrix NetScaler ADC and NetScaler Gateway - CVE-2026-19490 and CVE-2026-19489
Analysis Summary
# Vulnerability: Citrix NetScaler Authentication Bypass and Buffer Overflow
## CVE Details
- **CVE ID:** CVE-2026-19490
- **CVSS Score:** Not explicitly listed in text (Severity: High/Critical based on bypass nature)
- **CWE:** CWE-288 (Authentication Bypass Using an Alternate Path or Channel)
- **CVE ID:** CVE-2026-19489
- **CVSS Score:** Not explicitly listed in text (Severity: Medium/High)
- **CWE:** CWE-120 (Buffer Copy without Checking Size of Input / Classic Buffer Overflow)
## Affected Systems
- **Products:** NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway).
- **Versions:**
- NetScaler 14.1 (versions prior to 14.1-73.32)
- NetScaler 13.1 (versions prior to 13.1-63.21)
- NetScaler ADC FIPS 14.1 (prior to 14.1-73.32 FIPS)
- NetScaler ADC FIPS and NDcPP 13.1 (prior to 13.1-37.277)
- **Configurations:**
- Appliances must be configured as a **SAML IdP** (Identity Provider).
- Appliances configured for SSL VPN, ICA Proxy, CVPN, RDP Proxy, or as an AAA virtual server.
## Vulnerability Description
- **CVE-2026-19490:** A logic flaw allows a remote, unauthenticated attacker to bypass authentication controls by using an alternate path. This permits unauthorized access to resources protected by the Gateway or AAA virtual server.
- **CVE-2026-19489:** A classic buffer overflow flaw where the system does not properly validate input size before copying to a buffer. This can lead to memory corruption, unpredictable system behavior, or a Denial of Service (DoS) condition.
## Exploitation
- **Status:** Not explicitly stated as "in the wild" in this alert, but prioritized for emergency patching.
- **Complexity:** Low (Remote, unauthenticated access for the bypass).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** High (Authentication bypass allows unauthorized access to data).
- **Integrity:** High (Potential for unauthorized system actions).
- **Availability:** High (Buffer overflow leads to DoS).
## Remediation
### Patches
Update to the following versions or later:
- **NetScaler 14.1:** 14.1-73.32
- **NetScaler 13.1:** 13.1-63.21
- **NetScaler ADC FIPS 14.1:** 14.1-73.32 FIPS
- **NetScaler ADC FIPS and NDcPP 13.1:** 13.1-37.277
### Workarounds
No specific software workarounds were provided in the text; however, the Cyber Centre recommends prioritizing the emergency installation of the vendor-supplied patches.
## Detection
### Indicators of Compromise (IoC) / Config Checks
Search the NetScaler configuration for the following strings to identify vulnerability exposure:
- **For CVE-2026-19489:** `add lsn group.*sipalg.*`
- **For CVE-2026-19490:**
- `add authentication samlAction.*`
- `add authentication vserver .*`
- `add vpn vserver .*`
### Detection Methods
- Monitor authentication logs for unusual or successful logins from unexpected IP addresses.
- Review network activity for irregular traffic patterns originating from the NetScaler appliance.
- Verify appliance versions and audit AAA/Gateway configurations for SAML IdP usage.
## References
- Citrix Security Advisory: [https]://support.citrix.com/s/article/CTX694799 (Defanged reference)
- Cyber Centre Alert AL26-019: [https]://www.cyber.gc.ca/en/alerts-advisories/al26-019-vulnerabilities-impacting-citrix-netscaler-adc-netscaler-gateway-cve-2026-19490-cve-2026-19489
- NVD CVE-2026-19490: [https]://nvd.nist.gov/vuln/detail/CVE-2026-19490
- NVD CVE-2026-19489: [https]://nvd.nist.gov/vuln/detail/CVE-2026-19489