**Citrix** has issued critical security updates to remediate two vulnerabilities impacting **NetScaler ADC** and **NetScaler Gateway** deployments. These flaws include a high-severity memory overflow and a critical authentication bypass vulnerability. ### Affected Products and Versions The vulnerabilities primarily affect customer-managed **NetScaler ADC** and **NetScaler Gateway** instances, including specific **FIPS** and **NDcPP** builds, as well as **SecurAccess ZTNA Hybrid** deployments leveraging customer-managed **NetScaler** instances. It's important to note that **Citrix-managed cloud services** and **Citrix-managed Adaptive Authentication** are not impacted, as these services have already received the necessary updates. **Impacted NetScaler versions include:** * **NetScaler ADC** and **NetScaler Gateway** 14.1 BEFORE 14.1-73.32 * **NetScaler ADC** and **NetScaler Gateway** 13.1 BEFORE 13.1-63.21 * **NetScaler ADC FIPS** BEFORE 14.1-73.32 FIPS * **NetScaler ADC FIPS** and **NDcPP** BEFORE 13.1-37.277 ### Details of the Vulnerabilities Two distinct vulnerabilities have been identified: 1. **CVE-2026-19489** (CVSS score: 8.8): This is a memory overflow vulnerability that could lead to unpredictable behavior or a Denial-of-Service (DoS) condition. This flaw is only applicable when **Session Initiation Protocol Application Layer Gateway (SIP ALG)** is enabled on a **Large Scale NAT (LSN)** group configuration. 2. **CVE-2026-19490** (CVSS score: 9.3): This is the more severe of the two, representing a critical authentication bypass vulnerability. It affects appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server, provided specific version-dependent requirements are met. * **14.1-43.56 or later**: Applicable only when configured with a **SAML action** AND **NetScaler** is configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver. * **14.1-66.68-FIPS or later**: Applicable only when configured with a **SAML action** AND **NetScaler** is configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver. * **14.1-43.55 or earlier**: Applicable when configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver. * **13.1-61.28 or later**: Applicable only when configured with a **SAML action**. * **13.1-61.27 or earlier**: Applicable when configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver. * **13.1 FIPS**: Applicable when configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver. ### Mitigation and Updates **Citrix** advises customers to review their configurations to determine if the documented preconditions apply to their deployments. Prioritization of updates should be based on exposure, deployment role, and whether the affected configurations are enabled. For **CVE-2026-19489**, administrators can check their **NetScaler** configuration for the string `add lsn group.*sipalg.*`. For **CVE-2026-19490**, verification involves checking for `add authentication samlAction.*` (for SAML action configuration) or `add authentication vserver .*` or `add vpn vserver .*` (for AAA or VPN vserver). Additionally, **CVE-2026-19490** can be mitigated using signatures if **NetScaler Console** (Service or on-prem) is in use, and the **NetScaler** firmware version is 14.1-60.52 or higher, or 13.1-63.16 or higher. These versions include a feature called **Global Deny Lists**, which consumes and automatically applies signatures to **NetScaler** appliances managed via **NetScaler Console**. This feature is enabled by default. ### Available Patches Updates are available in the following versions: * **NetScaler ADC** and **NetScaler Gateway** 14.1-73.32 or later * **NetScaler ADC** and **NetScaler Gateway** 13.1-63.21 or later * **NetScaler ADC FIPS** 14.1-73.32 FIPS or later * **NetScaler ADC FIPS** and **NDcPP** 13.1-37.277 or later ### Acknowledgment and Warning **Citrix** credits **Samarth Vashisht** from the pen-test team at **JPMorgan Chase** for discovering and reporting these flaws. While there is currently no evidence of in-the-wild exploitation, newly disclosed **Citrix** vulnerabilities have historically become prime targets for attackers. This follows recent events where an insufficient input validation vulnerability in **NetScaler ADC** and **NetScaler Gateway** (**CVE-2026-8451**, CVSS score: 8.8) saw active exploitation within 24 hours of its public disclosure last month. This trend underscores the urgency for organizations to apply these patches without delay.