Exploitation Expected for Critical Authentication Bypass Patched in Citrix NetScaler
Citrix on Wednesday announced patches for two vulnerabilities in NetScaler ADC and NetScaler Gateway, including a critical-severity flaw.
The critical bug, tracked as CVE-2026-19490 (CVSS score of 9.3), is described as an authentication bypass using an alternative path, and impacts NetScaler appliances configured as a gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server.
It can be exploited by remote, unauthenticated attackers without user interaction, cybersecurity firm Rapid7 says.
Per Citrix’s advisory, the security defect impacts NetScaler ADC and NetScaler Gateway versions 14.1-43.56 or later, 14.1-66.68-FIPS or later, 14.1-43.55 or earlier, 13.1-61.28 or later, 13.1-61.27 or earlier, and 13.1 FIPS.
NetScaler ADC and Gateway versions 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS, and 13.1-FIPS and 13.1-NDcPP 13.1-37.277 contain fixes for this flaw and for CVE-2026-19489, a high-severity memory overflow issue that could lead to unexpected behavior or denial-of-service (DoS) if SIP ALG is enabled at an LSN group...
Copyright of this story solely belongs to securityweek.com. To see the full text click HERE
