Full Report
Citrix has released updates to address two security flaws impacting NetScaler ADC and NetScaler Gateway deployments, including a critical-severity authentication bypass vulnerability. According to the cloud computing and virtualization technology company, the issues affect customer-managed NetScaler ADC and NetScaler Gateway, including certain FIPS and NDcPP builds, as well as SecurAccess
Analysis Summary
# Vulnerability: Critical NetScaler Authentication Bypass and Memory Overflow
## CVE Details
- **CVE ID:** CVE-2026-19490
- **CVSS Score:** 9.3 (Critical)
- **CWE:** Authentication Bypass
- **CVE ID:** CVE-2026-19489
- **CVSS Score:** 8.8 (High)
- **CWE:** Memory Overflow
## Affected Systems
- **Products:** NetScaler ADC and NetScaler Gateway (Customer-managed), including FIPS and NDcPP builds; SecurAccess ZTNA Hybrid (customer-managed instances).
- **Versions:**
- 14.1 prior to 14.1-73.32
- 13.1 prior to 13.1-63.21
- 14.1 FIPS prior to 14.1-73.32 FIPS
- 13.1 FIPS/NDcPP prior to 13.1-37.277
- **Configurations:**
- **CVE-2026-19490:** Appliances configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. Certain sub-versions specifically require a SAML action to be configured to be vulnerable.
- **CVE-2026-19489:** Only applies when Session Initiation Protocol Application Layer Gateway (SIP ALG) is enabled on a Large Scale NAT (LSN) group.
## Vulnerability Description
CVE-2026-19490 is a critical authentication bypass vulnerability allowing unauthorized access to restricted resources on NetScaler Gateway or AAA servers. CVE-2026-19489 is a memory overflow vulnerability that can be triggered through specific SIP ALG configurations, leading to denial-of-service (DoS) or unpredictable system behavior.
## Exploitation
- **Status:** Not exploited in the wild (as of reporting); No PoC currently available.
- **Complexity:** Not specified (likely Low to Medium given the nature of bypasses).
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Full bypass of authentication)
- **Integrity:** High
- **Availability:** High (DoS via memory overflow)
## Remediation
### Patches
Update to the following versions or later:
- NetScaler ADC / Gateway: **14.1-73.32**
- NetScaler ADC / Gateway: **13.1-63.21**
- NetScaler ADC FIPS: **14.1-73.32 FIPS**
- NetScaler ADC FIPS and NDcPP: **13.1-37.277**
### Workarounds
- **Global Deny Lists:** For NetScaler firmware higher than 14.1-60.52 or 13.1-63.16, use NetScaler Console to apply signatures via the Global Deny List feature.
- **Configuration Review:** If patching is delayed, disable SIP ALG on LSN groups to mitigate CVE-2026-19489.
## Detection
### Indicators of Compromise
- Check configuration files for the following strings to determine exposure:
- `add lsn group.*sipalg.*` (for CVE-2026-19489)
- `add authentication samlAction.*`
- `add authentication vserver .*` or `add vpn vserver .*` (for CVE-2026-19490)
### Detection methods and tools
- Use NetScaler Console (Service or on-prem) to ingest and apply security signatures automatically.
## References
- Citrix Security Advisory: hxxps://support[.]citrix[.]com/support-home/kbsearch/article?articleNumber=CTX696939
- Citrix TechZone Blog: hxxps://community[.]citrix[.]com/techzone-blogs/110_security-updates/security-update-netscaler-adc-and-netscaler-gateway-vulnerabilities-r1602/