Citrix Patches Critical NetScaler Authentication Bypass Flaw

Citrix has rolled out security updates for two vulnerabilities affecting NetScaler ADC and NetScaler Gateway, including a critical authentication bypass flaw that could give attackers unauthorized access to enterprise network infrastructure. The flaws impact customer-managed NetScaler ADC and NetScaler Gateway deployments, along with select FIPS and NDcPP builds and SecurAccess ZTNA Hybrid environments relying on customer-managed instances. Citrix-managed cloud services and Adaptive Authentication are not affected, as patches were applied automatically.

The more severe issue, tracked as CVE-2026-19490 with a CVSS score of 9.3, is an authentication bypass that hits appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server. On versions 14.1-43.56 and later, as well as 14.1-66.68-FIPS and later, exploitation requires a SAML action to be configured. Earlier 14.1 builds (14.1-43.55 and below) and 13.1 releases (13.1-61.28 and later, with SAML) are also vulnerable, alongside 13.1 FIPS instances. Organizations relying on SSL VPN gateways should verify their SAML configurations immediately and consider running a SSL/TLS checker to validate their certificate posture across remote access endpoints.

The second flaw, CVE-2026-19489 (CVSS 8.8), is a memory overflow vulnerability that can trigger unpredictable behavior or denial-of-service, but only when Session Initiation Protocol Application Layer Gateway (SIP ALG) is enabled within a Large Scale NAT (LSN) group configuration. Affected versions include NetScaler ADC and Gateway 14.1 before 14.1-73.32, 13.1 before 13.1-63.21, 14.1 FIPS before 14.1-73.32 FIPS, and 13.1 FIPS/NDcPP before 13.1-37.277. Admins can confirm exposure by inspecting their NetScaler configuration for the strings "add lsn group.*sipalg.*" and "add authentication samlAction.*" combined with "add authentication vserver .*" or "add vpn vserver .*".

Given that CVE-2026-19490 essentially erases the authentication layer for SAML-enabled gateways, security teams should patch without delay and audit logs for signs of suspicious session activity. Citrix urged customers to base remediation priority on exposure and deployment role. As a follow-up precaution, defenders should review credential hygiene across remote access users with a password checker and confirm that no rogue proxies are tunneling through the gateway using a VPN/proxy detector. With a CVSS of 9.3 and active exploitation risk typical of authentication bypass bugs, this is one of the most urgent enterprise patching items of the cycle.