Citrix is urging administrators of NetScaler systems to quickly install updates to address two new vulnerabilities. One vulnerability could, under certain circumstances, allow an attacker to bypass authentication on NetScaler Gateway and ADC. So far, there are no indications of active exploitation.
The most serious vulnerability is CVE-2026-19490, according to BleepingComputer. An attacker does not need an existing account or other privileges to exploit this vulnerability. Exploitation could bypass authentication when NetScaler is deployed as an AAA virtual server or Gateway. This includes configurations for SSL VPN, ICA Proxy, CVPN, and RDP Proxy, among others.
Whether an environment is actually vulnerable depends, among other things, on the firmware used and the presence of a SAML Action configuration. Citrix has therefore provided administrators with instructions to check their configurations and determine whether the conditions for exploitation are met.
DoS via a second vulnerability
In addition, Citrix is addressing CVE-2026-19489, a vulnerability that can cause a memory overflow. Again, an attacker does not need to be logged in to exploit this. The vulnerability can be used to cause a denial-of-service (DoS) attack.
The attack is only possible under specific configurations. SIP ALG must be enabled within a large-scale NAT group. As a result, not every NetScaler installation is automatically vulnerable.
Citrix advises customers using NetScaler ADC and NetScaler Gateway to upgrade to version 14.1-73.32 or 13.1-63.21 and later releases. Separate updated builds are available for FIPS and NDcPP editions. This advisory also covers SecurAccess ZTNA Hybrid environments that use customer-managed NetScaler instances.
The company advises organizations to review their configurations and update affected systems as soon as possible.
Previous vulnerabilities quickly exploited
According to available information, no attacks exploiting CVE-2026-19489 or CVE-2026-19490 have been observed yet. Nevertheless, NetScaler’s recent history makes prompt patching important, according to Citrix.
For example, in March, the company warned about CVE-2026-3055 and CVE-2026-4368. A few days later, it turned out that attackers were indeed exploiting these vulnerabilities. CISA subsequently added CVE-2026-3055 to its Known Exploited Vulnerabilities catalog and gave U.S. federal agencies three days to secure vulnerable systems.
NetScaler has also been a frequent target. Over the past five years, CISA has recorded 22 vulnerabilities in Citrix products that have been confirmed to be actively exploited. Six of these were also used in ransomware attacks.
The potential attack surface is substantial. Shadowserver identifies more than 22,000 NetScaler ADC systems and nearly 1,800 NetScaler Gateway instances worldwide that are accessible from the internet. This data does not indicate how many systems are vulnerable to the two vulnerabilities that have now been patched.