Vulnerabilities · 53 days ago
Citrix NetScaler Bypass Targets Trust Roles Citrix and national CERTs published day-zero fixes on Aug. 20 for two NetScaler flaws, including CVE-2026-19490 , an authentication bypass in NetScaler ADC and NetScaler Gateway. The better-known issue is CVE-2026-19490 ; the second bug, CVE-2026-19489 , is a memory overflow tied to a separate SIP ALG configuration path.
The bypass works only when the appliance is set up as a Gateway, AAA virtual server, or SAML identity provider. In those roles, a request can slip around the normal login check through an alternate path, so a remote attacker may reach access and identity functions without credentials; the overflow can instead trigger unpredictable behavior or denial of service.
That means the exposure is concentrated at remote-access and perimeter choke points, not spread evenly across every NetScaler box. If NetScaler sits in front of VPN, SSO, or other trust boundaries, this flaw turns the appliance into a front door rather than just another edge service, even though no exploitation has been observed yet.
NVD KEV
Known exploited · CISA KEV
CISA federal remediation date Sep 12
CVE-2026-19489 NVD KEV
Timeline Sources 11 sources covering this story
Help Net Security Aug 21
Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490) - Help Net Security
Citrix patched two vulnerabilities in NetScaler ADC and Gateway, including a critical bypass flaw, CVE-2026-19490.
CSO Online Aug 20
Citrix issues critical security updates for its NetScaler devices
A memory overflow vulnerability and an authentication bypass both require urgent attention.
The Hacker News Aug 20
Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers
Citrix fixes NetScaler CVE-2026-19490, a CVSS 9.3 authentication bypass affecting certain Gateway, AAA, and SAML configurations.
CERT-SE Aug 20
Kritisk sårbarhet i Citrix NetScaler ADC och NetScaler Gateway - CERT-SE
Citrix har publicerat information om en kritisk sårbarhet som påverkar Citrix NetScaler ADC och NetScaler Gateway.
CSIRT Italia / ACN Aug 20
Vulnerabilità in prodotti Citrix
Aggiornamenti di sicurezza Citrix sanano due vulnerabilità con gravità "alta" nei prodotti NetScaler ADC (precedentemente noto come Citrix ADC) e NetScaler Gateway (precedentemente noto come Citrix Gateway).
SecurityWeek Aug 20
Exploitation Expected for Critical Authentication Bypass Patched in Citrix NetScaler
Remote, unauthenticated attackers could exploit the critical-severity flaw without user interaction.
BleepingComputer Aug 20
Citrix urges admins to patch new NetScaler flaws as soon as possible
Citrix has warned customers to immediately secure their systems against two vulnerabilities affecting NetScaler Gateway secure remote access solutions and NetScaler ADC networking appliances.
INCIBE-CERT Aug 20
Múltiples vulnerabilidades en NetScaler ADC y NetScaler Gateway de Citrix
Citrix ha publicado 2 vulnerabilidades: 1 de severidad crítica y 1 de severidad alta que, en caso de s
NCSC-NL Advisories Aug 20
Kwetsbaarheden verholpen in Citrix NetScaler ADC en NetScaler Gateway Revisies
De kwetsbaarheid met kenmerk CVE-2026-19489 betreft een memory overflow in NetScaler ADC en NetScaler Gateway, wanneer de producten zijn geconfigureerd als SIP ALG binnen een Large Scale NAT (LSN) groep.
Rapid7 Aug 19
CVE-2026-19490 Critical Vulnerability Affecting Citrix Netscaler ADC and Netscaler Gateway
On August 19, 2026, a security advisory was published for CVE-2026-19490, a critical authentication bypass vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway.
CERT-EU Advisories Aug 19
Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway
Entities CVE-2026-19490 CVE-2026-19489 Vendor digest: Citrix
Part of the PlainSec briefing for 2026-08-24
Editions Related stories Vulnerabilities · 53 days ago
Citrix NetScaler Bypass Targets Trust Roles Citrix and national CERTs published day-zero fixes on Aug. 20 for two NetScaler flaws, including CVE-2026-19490 , an authentication bypass in NetScaler ADC and NetScaler Gateway. The better-known issue is CVE-2026-19490 ; the second bug, CVE-2026-19489 , is a memory overflow tied to a separate SIP ALG configuration path.
The bypass works only when the appliance is set up as a Gateway, AAA virtual server, or SAML identity provider. In those roles, a request can slip around the normal login check through an alternate path, so a remote attacker may reach access and identity functions without credentials; the overflow can instead trigger unpredictable behavior or denial of service.
That means the exposure is concentrated at remote-access and perimeter choke points, not spread evenly across every NetScaler box. If NetScaler sits in front of VPN, SSO, or other trust boundaries, this flaw turns the appliance into a front door rather than just another edge service, even though no exploitation has been observed yet.
NVD KEV
Known exploited · CISA KEV
CISA federal remediation date Sep 12
CVE-2026-19489 NVD KEV
Timeline Sources 11 sources covering this story
Help Net Security Aug 21
Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490) - Help Net Security
Citrix patched two vulnerabilities in NetScaler ADC and Gateway, including a critical bypass flaw, CVE-2026-19490.
CSO Online Aug 20
Citrix issues critical security updates for its NetScaler devices
A memory overflow vulnerability and an authentication bypass both require urgent attention.
The Hacker News Aug 20
Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers
Citrix fixes NetScaler CVE-2026-19490, a CVSS 9.3 authentication bypass affecting certain Gateway, AAA, and SAML configurations.
CERT-SE Aug 20
Kritisk sårbarhet i Citrix NetScaler ADC och NetScaler Gateway - CERT-SE
Citrix har publicerat information om en kritisk sårbarhet som påverkar Citrix NetScaler ADC och NetScaler Gateway.
CSIRT Italia / ACN Aug 20
Vulnerabilità in prodotti Citrix
Aggiornamenti di sicurezza Citrix sanano due vulnerabilità con gravità "alta" nei prodotti NetScaler ADC (precedentemente noto come Citrix ADC) e NetScaler Gateway (precedentemente noto come Citrix Gateway).
SecurityWeek Aug 20
Exploitation Expected for Critical Authentication Bypass Patched in Citrix NetScaler
Remote, unauthenticated attackers could exploit the critical-severity flaw without user interaction.
BleepingComputer Aug 20
Citrix urges admins to patch new NetScaler flaws as soon as possible
Citrix has warned customers to immediately secure their systems against two vulnerabilities affecting NetScaler Gateway secure remote access solutions and NetScaler ADC networking appliances.
INCIBE-CERT Aug 20
Múltiples vulnerabilidades en NetScaler ADC y NetScaler Gateway de Citrix
Citrix ha publicado 2 vulnerabilidades: 1 de severidad crítica y 1 de severidad alta que, en caso de s
NCSC-NL Advisories Aug 20
Kwetsbaarheden verholpen in Citrix NetScaler ADC en NetScaler Gateway Revisies
De kwetsbaarheid met kenmerk CVE-2026-19489 betreft een memory overflow in NetScaler ADC en NetScaler Gateway, wanneer de producten zijn geconfigureerd als SIP ALG binnen een Large Scale NAT (LSN) groep.
Rapid7 Aug 19
CVE-2026-19490 Critical Vulnerability Affecting Citrix Netscaler ADC and Netscaler Gateway
On August 19, 2026, a security advisory was published for CVE-2026-19490, a critical authentication bypass vulnerability affecting Citrix NetScaler ADC and NetScaler Gateway.
CERT-EU Advisories Aug 19
Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway
Entities CVE-2026-19490 CVE-2026-19489 Vendor digest: Citrix
Part of the PlainSec briefing for 2026-08-24
Editions Related stories