**Citrix** is calling on customers to promptly secure their systems against two newly disclosed vulnerabilities affecting **NetScaler Gateway** secure remote access solutions and **NetScaler ADC** networking appliances. ### Critical Authentication Bypass Flaw The more severe of the two, tracked as **CVE-2026-19490**, poses a significant threat. This vulnerability could allow unprivileged remote attackers to bypass authentication when the appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy), depending on the **NetScaler** firmware version and if **SAML Action** is configured. Admins can determine if an appliance is susceptible to **CVE-2026-19490** by examining their **NetScaler** configuration for the `add authentication samlAction .*` string and `add authentication vserver .*` and `add vpn vserver .*` strings. ### High-Severity Denial-of-Service Risk The second vulnerability, a high-severity memory overflow flaw tracked as **CVE-2026-19489**, could be leveraged by remote unauthenticated threat actors to launch denial-of-service (DoS) attacks. This is possible when **SIP ALG** (Session Initiation Protocol Application Layer Gateway) is enabled on a large-scale NAT group configuration. Security teams can check for preconditions for **CVE-2026-19489** exploitation by inspecting their configuration for the `add lsn group.*sipalg.*` string. ### Recommended Actions **Citrix** has provided specific upgrade paths for vulnerable **NetScaler ADC** and **NetScaler Gateway** appliances: * **NetScaler ADC** and **NetScaler Gateway** 14.1-73.32 or later * **NetScaler ADC** and **NetScaler Gateway** 13.1-63.21 or later * **NetScaler ADC FIPS** 14.1-73.32 FIPS or later * **NetScaler ADC FIPS** and **NDcPP** 13.1-37.277 or later (as applicable) "We strongly recommend that customers review the [official NetScaler ADC and NetScaler Gateway security bulletin](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939), assess whether their deployments are affected, and upgrade impacted appliances to the recommended builds as soon as possible," **Citrix** stated in a recent warning. This also applies to **SecurAccess ZTNA Hybrid** (formerly **Secure Private Access Hybrid**) deployments utilizing customer-managed **NetScaler** instances. ### A History of Exploitation While these specific vulnerabilities have not yet been observed in active exploitation, **Citrix** previously urged admins to patch two other **NetScaler** flaws (**CVE-2026-3055** and **CVE-2026-4368**) on March 23, just days before attackers began actively abusing them. The **CISA** (Cybersecurity and Infrastructure Security Agency) subsequently added **CVE-2026-3055** to its **Known Exploited Vulnerabilities (KEV) Catalog** on March 30, mandating federal agencies to secure affected **Citrix** appliances within three days. Over the past five years, **CISA** has identified 22 **Citrix** vulnerabilities as exploited in the wild, with six of these also being leveraged in ransomware attacks. Monitoring by the **ShadowServer Foundation** indicates over 22,000 **NetScaler ADC** and nearly 1,800 **NetScaler Gateway** instances are currently exposed online. However, it does not specify how many of these might be vulnerable to the newly disclosed **CVE-2026-19489** and **CVE-2026-19490** flaws.