Citrix and national CERTs published day-zero fixes on Aug. 20 for two NetScaler flaws, including CVE-2026-19490, an authentication bypass in NetScaler ADC and NetScaler Gateway. The better-known issue is CVE-2026-19490; the second bug, CVE-2026-19489, is a memory overflow tied to a separate SIP ALG configuration path.
The bypass works only when the appliance is set up as a Gateway, AAA virtual server, or SAML identity provider. In those roles, a request can slip around the normal login check through an alternate path, so a remote attacker may reach access and identity functions without credentials; the overflow can instead trigger unpredictable behavior or denial of service.
That means the exposure is concentrated at remote-access and perimeter choke points, not spread evenly across every NetScaler box. If NetScaler sits in front of VPN, SSO, or other trust boundaries, this flaw turns the appliance into a front door rather than just another edge service, even though no exploitation has been observed yet.