Critical Citrix NetScaler Flaw Allows Attackers to Bypass Authentication

Cloud Software Group has issued a critical security bulletin regarding two vulnerabilities that affect customer-managed NetScaler ADC and NetScaler Gateway appliances.

Among these, there is an authentication-bypass flaw that could expose remote-access environments to unauthenticated breaches.

Citrix NetScaler Flaw

The most severe issue, tracked as CVE-2026-19490, has a CVSS v4 base score of 9.3 and is classified as CWE-288, which refers to “Authentication Bypass Using an Alternate Path.”

This flaw could enable a remote, unauthenticated attacker to bypass authentication controls when the vulnerable appliance is configured as a Gateway or AAA virtual server under specific conditions.

This issue is particularly concerning because NetScaler Gateway deployments often serve as the entry point to enterprise networks, providing access to SSL VPN, ICA Proxy, CVPN, and RDP Proxy.

A successful authentication bypass in such settings could allow an attacker to access applications and services that are normally secured by identity and access controls.

The exact exposure conditions for CVE-2026-19490 vary based on the appliance version and configuration. For NetScaler 14.1 releases from 14.1-43.56 onward, the vulnerability is present when administrators have configured both a SAML action and either a Gateway service or AAA virtual server.

For earlier builds of 14.1, including 14.1-43.55 and earlier, the appliance may be vulnerable when configured as a Gateway or AAA virtual server, regardless of the SAML configuration.

A similar distinction applies to the 13.1 branch: versions from 13.1-61.28 onward require a SAML action to trigger the vulnerability, while versions 13.1-61.27 and earlier are affected when either Gateway or AAA virtual server functionality is enabled.

Administrators can check for potentially exposed configurations by reviewing NetScaler configuration files for SAML action entries:

add authentication samlAction

They should also look for authentication or VPN virtual-server configurations:

add authentication vserver 
add vpn vserver 

The bulletin also addresses CVE-2026-19489, a memory-overflow vulnerability with a CVSS v4 score of 8.8. This flaw, categorized as CWE-119, involves improper restrictions on operations within a memory buffer.

Exploitation of this vulnerability can lead to unpredictable behavior or a denial of service. However, it requires SIP ALG to be enabled on a Large Scale NAT group configuration. Organizations can assess this precondition by inspecting configurations for the following pattern:

add lsn group.sipalg.

Affected releases include NetScaler ADC and Gateway 14.1 before 14.1-73.32, 13.1 before 13.1-63.21, 14.1 FIPS before 14.1-73.32 FIPS, and 13.1 FIPS/NDcPP before 13.1-37.277. Secure Private Access Hybrid deployments using NetScaler instances are also impacted.

Cloud Software Group has released fixed builds and urges customers to upgrade immediately. There are no workarounds or mitigation measures available for either vulnerability.

The recommended target versions are:

• NetScaler ADC and Gateway 14.1-73.32 or later
• NetScaler ADC and Gateway 13.1-63.21 or later
• NetScaler ADC 14.1-FIPS 14.1-73.32 FIPS or later
• NetScaler ADC 13.1-FIPS and NDcPP 13.1-37.277 or later

Cloud Software Group is updating citrix-managed cloud services and Citrix-managed Adaptive Authentication. The company credits Samarth Vashisht of JPMorgan Chase’s pen-testing team for responsibly reporting these vulnerabilities.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC