Citrix patches critical NetScaler Gateway authentication bypass

Citrix has released updates for two vulnerabilities in customer-managed NetScaler ADC and NetScaler Gateway deployments, including CVE-2026-19490, an authentication bypass flaw with a CVSS score of 9.3. The issue can affect appliances configured as a Gateway for SSL VPN, ICA Proxy, CVPN or RDP Proxy, or as an AAA virtual server, subject to version-specific configuration conditions.

The vendor also fixed CVE-2026-19489, a memory overflow vulnerability rated 8.8 that may cause unpredictable behaviour or denial of service. It applies only where Session Initiation Protocol Application Layer Gateway, or SIP ALG, is enabled on a Large Scale NAT group configuration.

Which NetScaler deployments are affected

The advisory covers customer-managed NetScaler ADC and NetScaler Gateway systems, including certain FIPS and NDcPP builds. SecurAccess ZTNA Hybrid deployments using customer-managed NetScaler instances are also in scope. Citrix-managed cloud services and Citrix-managed Adaptive Authentication are not affected because the required updates have already been applied.

Citrix lists fixed releases as NetScaler ADC and NetScaler Gateway 14.1-73.32 or later, 13.1-63.21 or later, NetScaler ADC FIPS 14.1-73.32 FIPS or later, and NetScaler ADC FIPS and NDcPP 13.1-37.277 or later. Organisations should compare both the installed release and the appliance role with the advisory conditions rather than treating all configurations in a branch as equally exposed.

Authentication bypass conditions vary by release

CVE-2026-19490 affects Gateway or AAA virtual-server deployments, but the prerequisites differ across builds. On 14.1-43.56 and later, as well as 14.1-66.68-FIPS and later, the appliance must have a SAML action configured. On 14.1-43.55 or earlier, the Gateway or AAA role alone is sufficient. For 13.1, releases from 13.1-61.28 require a SAML action, while 13.1-61.27 or earlier and 13.1 FIPS are affected when configured for the specified Gateway or AAA functions.

Administrators can inspect configurations for add authentication samlAction alongside add authentication vserver or add vpn vserver entries to assess the authentication-bypass preconditions. For the overflow issue, Citrix advises checking for an LSN group configuration containing sipalg.

Mitigation and operational priority

Citrix said NetScaler Console Service or on-premises NetScaler Console can mitigate the authentication bypass through signatures when managed firmware is above 14.1-60.52 or 13.1-63.16. Its Global Deny Lists feature consumes and automatically applies those signatures, and is enabled by default. This is a mitigation, not a substitute for installing the fixed firmware.

Citrix credited Samarth Vashisht of JPMorgan Chase's pen-test team with reporting the flaws and said there is no evidence of exploitation in the wild. The disclosure follows a NetScaler pattern that merits close attention: Cisco flaws, ClickFix chains and AI agent incidents shows how rapidly attackers can operationalise newly publicised weaknesses alongside other enterprise attack chains.

For security teams, the immediate business implication is to inventory customer-managed NetScaler appliances, prioritise internet-facing Gateway and AAA roles, validate the SAML and SIP ALG conditions, and schedule the applicable fixed release without relying solely on signature-based mitigation.