CVE-2026-19490: NetScaler Auth Bypass Patched

Cloud Software Group released a critical security bulletin for customer-managed NetScaler ADC and NetScaler Gateway deployments, fixing two vulnerabilities: CVE-2026-19490, an authentication bypass issue, and CVE-2026-19489, a memory overflow issue.

The higher-risk flaw is CVE-2026-19490, which can affect NetScaler appliances configured as a Gateway or AAA virtual server under specific version and configuration conditions. The second issue, CVE-2026-19489, affects deployments where SIP ALG is enabled on a Large Scale NAT (LSN) group.

Which NetScaler Vulnerabilities Were Fixed?

The two flaws do not have the same exposure profile. CVE-2026-19490 is the main perimeter-access concern because it affects Gateway and AAA configurations that may sit in front of VPN, proxy, and remote-access workflows. CVE-2026-19489 is narrower because exploitation requires SIP ALG to be enabled within an LSN group.

What Is CVE-2026-19490?

CVE-2026-19490 is an authentication bypass vulnerability in NetScaler ADC and NetScaler Gateway. Cloud Software Group classifies it as CWE-288: Authentication Bypass Using an Alternate Path and assigns it a CVSS v4.0 score of 9.3.

The issue can affect appliances configured as:

For some newer firmware ranges, the appliance must also be configured with a SAML action for CVE-2026-19490 to apply. Older affected builds may be exposed through Gateway or AAA virtual-server configurations even without that additional SAML condition.

Because NetScaler Gateway and AAA services often protect access to internal applications, virtual desktops, and remote-access sessions, this vulnerability should be prioritized on internet-facing systems.

What Is CVE-2026-19489?

CVE-2026-19489 is a memory overflow vulnerability in NetScaler ADC and NetScaler Gateway. Cloud Software Group classifies it as CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer and assigns it a CVSS v4.0 score of 8.8. The vendor describes the impact as unpredictable behavior or denial of service (DoS).

This flaw applies only when SIP ALG is enabled on a Large Scale NAT (LSN) group. That makes configuration review important: a NetScaler appliance may be on an affected version, but still not meet the specific precondition for CVE-2026-19489.

Which NetScaler Versions Are Affected?

Cloud Software Group lists the following affected supported versions and fixed builds:

Secure Private Access Hybrid deployments that use customer-managed NetScaler instances are also affected and must be upgraded to the recommended builds. The bulletin applies only to customer-managed NetScaler ADC and NetScaler Gateway instances; Cloud Software Group says Citrix-managed cloud services and Citrix-managed Adaptive Authentication have already received the required updates.

How Can Admins Check Whether Their Appliance Meets the Preconditions?

Cloud Software Group provides configuration strings that administrators can inspect to determine whether a NetScaler appliance meets the vulnerability preconditions.

For CVE-2026-19489, check whether SIP ALG is enabled on an LSN group:

add lsn group.*sipalg.*

For CVE-2026-19490, review SAML action and Gateway or AAA virtual-server configuration:

add authentication samlAction.*
add authentication vserver .*
add vpn vserver .*

These checks are useful for exposure validation, but they do not replace upgrading. Cloud Software Group lists no workarounds or mitigating factors for the bulletin.

Is CVE-2026-19490 Being Exploited?

At the time of writing, the Cloud Software Group advisory does not state that CVE-2026-19490 or CVE-2026-19489 has been exploited in the wild. The advisory also does not provide attacker indicators, exploit payloads, IP addresses, domains, hashes, or CVE-specific detection signatures.

SOCRadar’s Cyber Threat Intelligence (CTI) and Attack Surface Management (ASM) help security teams prioritize risks. ASM provides real-time visibility into your digital footprint to identify exposed internet-facing assets, while CTI delivers deep insights into emerging threats, threat actor trends, and exploit developments, enabling security teams to effectively prioritize patching and response strategies.

What Should Defenders Do Now?

1. Upgrade Affected NetScaler Appliances

Install the applicable fixed build for each affected branch. Prioritize internet-facing Gateway and AAA virtual servers first, especially systems configured for SSL VPN, ICA Proxy, CVPN, RDP Proxy, SAML authentication, or externally reachable remote access.

NetScaler Console Security Advisory supports CVE-2026-19490 and CVE-2026-19489 identification through version scanning and recommends upgrading to the builds listed in the security bulletin.

2. Validate Gateway, AAA, and SAML Exposure

For CVE-2026-19490, identify appliances configured as Gateway or AAA virtual servers. Then verify whether SAML action configuration is present where the vendor’s version-specific conditions require it.

Pay special attention to appliances that front access to internal applications, virtual desktops, remote desktops, or VPN services. These systems are high-value because authentication bypass risk can affect the access-control boundary between the internet and internal resources.

3. Check SIP ALG and LSN Use

For CVE-2026-19489, review whether SIP ALG is enabled on an LSN group. This condition is more specific than general NetScaler exposure, but affected configurations should still be upgraded to reduce denial-of-service and service instability risk.

4. Review Logs for Suspicious Activity

Because the advisory does not provide CVE-specific indicators, hunting should focus on behavior and configuration context.

For CVE-2026-19490, review NetScaler authentication logs, AAA logs, VPN and proxy session records, SAML identity-provider logs, and downstream application access logs. Look for successful sessions that do not align with expected identity-provider events, unusual authentication paths, unexpected source locations, abnormal session creation, or access outside normal user and device patterns.

For CVE-2026-19489, review appliance restarts, crashes, service errors, unusual SIP-related activity, and other instability on systems that meet the SIP ALG and LSN precondition.

5. Confirm Remediation After Upgrade

After updating, confirm that every appliance reports the correct fixed build. Recheck Gateway, AAA, SAML, SIP ALG, and LSN configuration. Also verify that Secure Private Access Hybrid deployments using customer-managed NetScaler instances are included in the remediation plan.