Skip to content

Citrix NetScaler CVE-2026-19489 / CVE-2026-19490 Gateway/AAA auth bypass and LSN/SIP-ALG DoS

Summary

On August 20, 2026, Citrix released updates for NetScaler ADC and NetScaler Gateway that fix two customer-managed vulnerabilities: CVE-2026-19490 (CVSS 9.3, reported as critical), an authentication bypass on appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server, and CVE-2026-19489 (CVSS 8.8), a memory overflow that can cause unpredictable behavior or denial of service but only when SIP ALG is enabled on a Large Scale NAT (LSN) group. No in-the-wild exploitation was reported at disclosure. The flaws are credited to Samarth Vashisht of JPMorgan Chase's pen-test team.

The authentication-bypass path matters most because NetScaler Gateway is frequently the internet-facing remote-access front door. On affected firmware that uses SAML actions on a Gateway/AAA virtual server, an unauthenticated attacker may reach protected resources without valid credentials. Citrix stresses that the vulnerable configuration is narrower than all deployments and that prioritization should be driven by exposure, deployment role, and whether the affected configuration is actually enabled.

Tags

Why this matters

  • NetScaler Gateway is commonly deployed as an internet-facing remote-access front door. An unauthenticated bypass on a Gateway/AAA vserver can expose protected resources without a valid credential.
  • The bypass is configuration-gated: it requires a Gateway (SSL VPN / ICA Proxy / CVPN / RDP Proxy) or AAA vserver, and on several firmware lines additionally a SAML action. Most NetScaler deployments that are not configured this way are not affected, so exposure must be measured per appliance.
  • The LSN/SIP-ALG DoS (CVE-2026-19489) is availability-only and only triggers when SIP ALG is enabled on an LSN group — a narrow but sometimes silently-enabled edge configuration.
  • This adds to a repeat pattern of high-impact NetScaler edge-appliance flaws: the June 2026 CitrixBleed-class CVE-2026-8451 memory overread was exploited within 24 hours of disclosure. A CVSS-9.3 pre-authentication bypass on remote-access infrastructure should be treated as patch-now, not patch-later.
  • Citrix-managed cloud services and Citrix-managed Adaptive Authentication are not affected (updates already applied); this affects customer-managed NetScaler ADC / Gateway, including certain FIPS and NDcPP builds, and SecurAccess ZTNA Hybrid deployments using customer-managed NetScaler instances.

Public vulnerability detail

  • Vendor patch / disclosure: 2026-08-20 (Citrix NetScaler ADC / Gateway updates).
  • CVEs: CVE-2026-19490 (authentication bypass), CVE-2026-19489 (memory overflow / DoS).
  • Vendor-reported CVSS (as reported by Citrix via The Hacker News): CVE-2026-19490 = 9.3; CVE-2026-19489 = 8.8. NVD had published CVSS v4 vector strings for both at capture time but no base score yet populated.
  • Affected / fixed versions (Citrix):
  • NetScaler ADC and NetScaler Gateway: 14.1 before 14.1-73.32, 13.1 before 13.1-63.21.
  • NetScaler ADC FIPS: before 14.1-73.32 FIPS.
  • NetScaler ADC FIPS and NDcPP: before 13.1-37.277.
  • Fixed in 14.1-73.32 or later, 13.1-63.21 or later, 14.1-73.32 FIPS or later, and 13.1-37.277 or later as applicable.
  • CVE-2026-19490 applicability (per version, per Citrix):
  • 14.1-43.56 or later: applicable only with a SAML action AND a Gateway or AAA vserver.
  • 14.1-66.68-FIPS or later: applicable only with a SAML action AND a Gateway or AAA vserver.
  • 14.1-43.55 or earlier: applicable when configured with a Gateway or AAA vserver.
  • 13.1-61.28 or later: applicable only with a SAML action.
  • 13.1-61.27 or earlier: applicable when configured with a Gateway or AAA vserver.
  • 13.1 FIPS: applicable when configured with a Gateway or AAA vserver.
  • CVE-2026-19489 applicability: SIP ALG enabled on an LSN group configuration.
  • No in-the-wild exploitation reported at disclosure; Citrix credited Samarth Vashisht (JPMorgan Chase pen-test team).

Precondition checks (as published by Citrix)

  • CVE-2026-19489 (LSN / SIP ALG DoS): inspect configuration for add lsn group.*sipalg.*.
  • CVE-2026-19490 (auth bypass): inspect configuration for add authentication samlAction.* (SAML action) together with add authentication vserver .* or add vpn vserver .* (AAA or VPN vserver).
  • Mitigation via signatures: if using NetScaler Console (Service or on-prem) on firmware newer than 14.1-60.52 / 13.1-63.16, the Global Deny Lists feature consumes signatures and auto-applies them to managed appliances. It is enabled by default.

Defender heuristics

  1. Inventory customer-managed NetScaler ADC / Gateway assets that are internet-facing or reachable from partner / remote-access networks. Identify which are configured as a Gateway (SSL VPN / ICA Proxy / CVPN / RDP Proxy) or AAA virtual server, and which use SAML actions.
  2. Patch affected branches to 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS, or 13.1-37.277 (or later) as applicable. Confirm Citrix-managed cloud services and Adaptive Authentication are already up to date.
  3. Where patching is delayed, run Citrix's precondition greps (add lsn group.*sipalg.*, add authentication samlAction.*, add authentication vserver .*, add vpn vserver .*) to determine which appliances actually satisfy the vulnerable configuration, and prioritize by exposure.
  4. Verify NetScaler Console Global Deny Lists signatures are active where available (firmware > 14.1-60.52 / 13.1-63.16), and confirm they are not disabled or overridden by local policy.
  5. For CVE-2026-19489, disable SIP ALG on LSN groups if it is not required for the traffic path.
  6. Review authentication logs for a sudden rise in successful Gateway / AAA sessions from unexpected source addresses or user agents, and for sessions that occurred without a corresponding valid credential flow, while the unpatched window remains open.
  7. Preserve appliance configuration and logs before disruptive remediation (edge appliances have short log retention and limited telemetry), and fold this into the broader NetScaler / CitrixBleed edge-appliance runbook: patch validation, SAML / AAA configuration review, session invalidation, source-IP clustering, and downstream lateral-movement checks from remote-access address pools.

Sources