Full Report
Citrix has warned customers to immediately secure their systems against two vulnerabilities affecting NetScaler Gateway secure remote access solutions and NetScaler ADC networking appliances. [...]
Analysis Summary
# Vulnerability: Critical Authentication Bypass and DoS in Citrix NetScaler
## CVE Details
- **CVE ID:** CVE-2026-19490 (Authentication Bypass), CVE-2026-19489 (Denial of Service)
- **CVSS Score:** Not explicitly listed in text; described as "Most Severe" and "High-severity"
- **CWE:** Improper Authentication (CVE-2026-19490); Memory Overflow (CVE-2026-19489)
## Affected Systems
- **Products:** NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). Includes FIPS and NDcPP builds, and SecureAccess ZTNA Hybrid deployments.
- **Versions:** All versions prior to the patched releases (14.1-73.32 and 13.1-63.21).
- **Configurations:**
- **For CVE-2026-19490:** Configured as an AAA virtual server or Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) with SAML Action enabled.
- **For CVE-2026-19489:** SIP ALG (Session Initiation Protocol Application Layer Gateway) enabled on a large-scale NAT (LSN) group.
## Vulnerability Description
- **CVE-2026-19490:** A critical flaw that allows an unauthenticated remote attacker to bypass authentication requirements. The vulnerability is triggered when specific SAML configurations are present on Gateway or AAA virtual servers.
- **CVE-2026-19489:** A memory overflow vulnerability. Remote unauthenticated attackers can trigger this flaw to cause a Denial of Service (DoS) state on appliances using specific Large Scale NAT and SIP ALG configurations.
## Exploitation
- **Status:** Not currently exploited in the wild (as of reporting date); no PoC mentioned as publicly available.
- **Complexity:** Low (Remote, unauthenticated)
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Full authentication bypass allows access to internal resources)
- **Integrity:** High
- **Availability:** High (DoS capability for CVE-2026-19489)
## Remediation
### Patches
Citrix recommends upgrading to the following versions or later:
- NetScaler ADC / Gateway: **14.1-73.32**
- NetScaler ADC / Gateway: **13.1-63.21**
- NetScaler ADC FIPS: **14.1-73.32 FIPS**
- NetScaler ADC FIPS and NDcPP: **13.1-37.277**
### Workarounds
No specific workarounds were provided in the article; immediate patching is urged due to the high risk of rapid exploitation.
## Detection
### Indicators of Compromise
Admins should audit configurations for the following strings to determine vulnerability:
- **For Auth Bypass:** Check for `add authentication samlAction .*` and the presence of `add authentication vserver .*` or `add vpn vserver .*`.
- **For DoS:** Check for the string `add lsn group.*sipalg.*`.
### Detection methods and tools
- Monitor system logs for unexpected authentication successes from unknown IP addresses.
- Monitor for appliance crashes or unexpected reboots associated with SIP traffic.
## References
- **Vendor Advisory:** hxxps[://]support[.]citrix[.]com/support-home/kbsearch/article?articleNumber=CTX696939
- **Citrix Tech Zone Blog:** hxxps[://]community[.]citrix[.]com/techzone-blogs/110_security-updates/security-update-netscaler-adc-and-netscaler-gateway-vulnerabilities-r1602/
- **NVD CVE-2026-19490:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-19490
- **NVD CVE-2026-19489:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-19489