Vulnerabilities & Exploits
Citrix NetScaler Bypass Targets Trust Roles Citrix and national CERTs published day-zero fixes on Aug. 20 for two NetScaler flaws, including CVE-2026-19490 , an authentication bypass in NetScaler ADC and NetScaler Gateway. The better-known issue is CVE-2026-19490 ; the second bug, CVE-2026-19489 , is a memory overflow tied to a separate SIP ALG configuration path.
The bypass works only when the appliance is set up as a Gateway, AAA virtual server, or SAML identity provider. In those roles, a request can slip around the normal login check through an alternate path, so a remote attacker may reach access and identity functions without credentials; the overflow can instead trigger unpredictable behavior or denial of service.
That means the exposure is concentrated at remote-access and perimeter choke points, not spread evenly across every NetScaler box. If NetScaler sits in front of VPN, SSO, or other trust boundaries, this flaw turns the appliance into a front door rather than just another edge service, even though no exploitation has been observed yet.
11 sources · Aug 21
NVD KEV
Known exploited · CISA KEV
CISA federal remediation date Sep 12
CVE-2026-19489 NVD KEV
Timeline Sources Aug 21 Help Net Security
Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490) - Help Net Security
Citrix patched two vulnerabilities in NetScaler ADC and Gateway, including a critical bypass flaw, CVE-2026-19490.
original Aug 20 CSO Online
Citrix issues critical security updates for its NetScaler devices
A memory overflow vulnerability and an authentication bypass both require urgent attention.
original Aug 20 The Hacker News
Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers
Citrix fixes NetScaler CVE-2026-19490, a CVSS 9.3 authentication bypass affecting certain Gateway, AAA, and SAML configurations.
original Vendor digest: Citrix
Part of the PlainSec briefing for 2026-08-22
Every edition of this story: Citrix NetScaler Bypass Targets Trust Roles
More from today Vulnerabilities & Exploits
Citrix NetScaler Bypass Targets Trust Roles Citrix and national CERTs published day-zero fixes on Aug. 20 for two NetScaler flaws, including CVE-2026-19490 , an authentication bypass in NetScaler ADC and NetScaler Gateway. The better-known issue is CVE-2026-19490 ; the second bug, CVE-2026-19489 , is a memory overflow tied to a separate SIP ALG configuration path.
The bypass works only when the appliance is set up as a Gateway, AAA virtual server, or SAML identity provider. In those roles, a request can slip around the normal login check through an alternate path, so a remote attacker may reach access and identity functions without credentials; the overflow can instead trigger unpredictable behavior or denial of service.
That means the exposure is concentrated at remote-access and perimeter choke points, not spread evenly across every NetScaler box. If NetScaler sits in front of VPN, SSO, or other trust boundaries, this flaw turns the appliance into a front door rather than just another edge service, even though no exploitation has been observed yet.
11 sources · Aug 21
NVD KEV
Known exploited · CISA KEV
CISA federal remediation date Sep 12
CVE-2026-19489 NVD KEV
Timeline Sources Aug 21 Help Net Security
Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490) - Help Net Security
Citrix patched two vulnerabilities in NetScaler ADC and Gateway, including a critical bypass flaw, CVE-2026-19490.
original Aug 20 CSO Online
Citrix issues critical security updates for its NetScaler devices
A memory overflow vulnerability and an authentication bypass both require urgent attention.
original Aug 20 The Hacker News
Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers
Citrix fixes NetScaler CVE-2026-19490, a CVSS 9.3 authentication bypass affecting certain Gateway, AAA, and SAML configurations.
original Vendor digest: Citrix
Part of the PlainSec briefing for 2026-08-22
Every edition of this story: Citrix NetScaler Bypass Targets Trust Roles
More from today