{"uuid": "62e6117f-a479-4d22-91a0-5d7cdda9ca0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "name": "NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19489 and CVE-2026-19490", "description": "Ref: [https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939)\n\n**Severity of Bulletin:** Critical\n\n### **Description of Problem**\n\nMultiple vulnerabilities have been discovered in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). Refer below for further details.\n\n**Affected Versions:**\u00a0\n-----------------------\n\nThe following supported versions of NetScaler ADC and NetScaler Gateway are affected by the vulnerabilities:\u00a0\n\n*   NetScaler ADC and NetScaler Gateway\u202f14.1\u202fBEFORE 14.1-73.32\n    \n*   NetScaler ADC and NetScaler Gateway\u202f13.1\u202fBEFORE 13.1-63.21\n    \n*   NetScaler ADC FIPS BEFORE 14.1-73.32 FIPS\n    \n*   NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.277\n    \n\n**Additional Note**: Secure Private Access Hybrid deployments using NetScaler instances are also affected by the vulnerabilities. Customers need to upgrade these NetScaler instances to the recommended NetScaler builds to address the vulnerabilities.\u00a0\n\nThis bulletin only applies to customer-managed NetScaler ADC and NetScaler Gateway. Cloud Software Group upgrades the Citrix-managed cloud services and Citrix-managed Adaptive Authentication with the necessary software updates.\n\nNetScaler ADC and NetScaler Gateway are affected by the vulnerabilities mentioned below\n\n**CVE-ID**\u00a0\n\n**Description**\n\n**Pre-conditions**\n\n**CWE**\n\n**CVSSv4**\n\nCVE-2026-19489\n\nMemory overflow vulnerability leading to unpredictable behavior or Denial of Service\n\nSIP ALG(Session Initiation Protocol Application Layer Gateway) should be enabled on a Large Scale NAT (LSN) group configuration.\u00a0\n\nCWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer\n\nCVSS v4.0 Base Score: 8.8\n\n(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/\n\nVC:L/VI:L/VA:H/SC:N/SI:N/SA:L)\n\nCVE-2026-19490\n\nAuthentication bypass using an alternate path\n\nThe appliance must be configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server, subject to the following version-specific requirements:\n\n*   **14.1-43.56 or later:** Applicable only when configured with a SAML action  \n    AND NetScaler is configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver\n    \n*   **14.1-66.68-FIPS or later:** Applicable only when configured with a SAML action AND NetScaler is configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver\n*   **14.1-43.55 or earlier:** Applicable when configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy ) or AAA vserver  \n      \n    \n*   **13.1-61.28 or later:** Applicable only when configured with a SAML action.  \n      \n    \n*   **13.1-61.27 or earlier:** Applicable when configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy)\u00a0 or AAA vserver  \n      \n    \n*   **13.1 FIPS:** Applicable when configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver.\n    \n\nCWE-288: Authentication Bypass Using an Alternate Path\u00a0\n\nCVSS v4.0 Base Score: 9.3\n\n(CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/\n\nVC:H/VI:H/VA:H/SC:L/SI:L/SA:L)\n\n###   \n**What Customers Should Do**\n\nCloud Software Group strongly urges affected customers of NetScaler ADC and NetScaler Gateway to install the relevant updated versions as soon as possible.\u00a0\n\n*   NetScaler ADC\u202fand NetScaler Gateway 14.1-73.32 and later releases\n    \n*   NetScaler ADC\u202fand NetScaler Gateway 13.1-63.21 and later releases of 13.1\n    \n*   NetScaler ADC 14.1-FIPS 14.1-73.32 FIPS and later releases of 14.1-FIPS\n    \n*   NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.277 and later releases of 13.1-FIPS and 13.1-NDcPP\n    \n\n**Steps to determine if an appliance meets the CVE preconditions**\n\n**For CVE-2026-19489:**\n\nCustomers can determine if the appliance meets the precondition by inspecting their NetScaler configuration for the specified string:\n\n*   **\"\u200badd lsn group.\\*sipalg.\\*\"**\u00a0\n    \n\n**For CVE-2026-19490:**\u00a0\n\nCustomers can determine if the appliance meets the precondition by inspecting their NetScaler configuration for the specified string:\n\n**SAML action configuration**\n\n*   \"**add authentication samlAction.\\***\"\n\n\u00a0**Auth or VPN vserver**\n\n*   \u00a0\"**add authentication vserver .\\***\"\n\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Or\u00a0\n\n*   \u00a0\"**add vpn vserver .\\***\"", "creation_timestamp": "2026-08-20T06:31:52.485941+00:00", "timestamp": "2026-08-20T06:31:52.485941+00:00", "related_vulnerabilities": ["CVE-2026-19489", "CVE-2026-19490"], "author": {"login": "adulau", "name": "Alexandre Dulaunoy", "uuid": "c933734a-9be8-4142-889e-26e95c752803"}}