CVE-2026-19490: Citrix NetScaler ADC/Gateway SAML Authentication Bypass, CVSS 9.3 — Urgent Upgrade for SSL VPN and AAA Virtual Servers

Citrix published NetScaler ADC and NetScaler Gateway security bulletin CTX696939 on 19 August. CVE-2026-19490 is an alternate-path authentication bypass, CVSS v4.0 9.3, affecting all fielded 14.1/13.1 versions configured with a SAML action or Gateway/AAA virtual server. Concurrent disclosure: CVE-2026-19489 memory overflow DoS, CVSS 8.8.

Citrix published emergency security bulletin CTX696939 for NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) on 19 August 2026, disclosing two high-severity vulnerabilities: CVE-2026-19490, an alternate-path authentication bypass, CVSS v4.0 9.3/10, and CVE-2026-19489, a memory overflow DoS, CVSS 8.8. CERT-EU, the Canadian Centre for Cyber Security, and ZeroDay News issued matching emergency notices. Upgrade all NetScaler deployments used as SSL VPN, ICA Proxy, CVPN, RDP Proxy, or AAA virtual servers to 14.1-73.32 or 13.1-63.21 immediately. Edge devices facing the public Internet should be hot-patched first in a maintenance window.

Incident Overview

Citrix NetScaler ADC and NetScaler Gateway sit at the enterprise network edge: application delivery, load balancing, SSL/TLS offload, VPN remote access. This bulletin covers the 14.1 and 13.1 lines. NetScaler ADC FIPS, NDCPP, and other certified branches are in scope. Cloud Software Group hosted cloud services are vendor-patched and out of scope. CVE-2026-19490 requires the appliance configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server; on 14.1-43.56 / 13.1-61.28 and later, a SAML action is also required. On earlier versions and 13.1 FIPS, Gateway/AAA vServer config alone is sufficient. CVE-2026-19489 requires an LSN (Large Scale NAT) group with the SIP ALG module enabled. Both are remotely triggerable by an unauthenticated attacker. No user interaction. No privilege elevation.

CERT-EU advisory 2026-010 gives vendor-aligned triage: search the NetScaler config for `add authentication samlAction.*`, `add authentication vserver .*`, or `add vpn vserver .*` to hit CVE-2026-19490 preconditions; search `add lsn group.*sipalg.*` for CVE-2026-19489. The Hacker News and ZDN note that CitrixBleed (CVE-2023-4966) in 2023 and CitrixBleed 2 (CVE-2025-5777) in 2025 already set this product line's public-edge weaponization cadence. CERT-EU, CCCS, and CyFAR listed CVE-2026-19490 as immediate-action priority before confirmed in-the-wild exploitation. Vendor and regulator consensus on NetScaler's disclose-to-exploit window is in place.

Technical Details

• CVSS v4.0: CVE-2026-19490 is 9.3 (vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L); CVE-2026-19489 is 8.8 (vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:L).

• Trigger components: authentication processing path and SIP ALG stack — SAML/AAA vServer and LSN group memory-management logic.

• Root cause: CVE-2026-19490 is authentication bypass using an alternate path or channel (CWE-288); the attacker skips the primary auth flow and defeats identity checks. CVE-2026-19489 is improper restriction of operations within the bounds of a memory buffer (CWE-119); SIP ALG out-of-bounds read while processing Session Initiation Protocol.

• Attack complexity: both network-reachable, unauthenticated, low complexity. No credentials. No prior interaction.

• Impact: CVE-2026-19490 yields high-privilege access to the NetScaler management plane or AAA-delegated systems after bypass. CVE-2026-19489 triggers unpredictable behavior or service interruption and can force-drop VoIP and media-gateway sessions that depend on LSN/NAT.

• Affected versions: 14.1 < 14.1-73.32, 13.1 < 13.1-63.21, 14.1-FIPS < 14.1-73.32 FIPS, 13.1-FIPS/NDcPP < 13.1-37.277. Secure Private Access Hybrid mode deployments are on the upgrade list.

• Fixed versions: NetScaler ADC/Gateway 14.1-73.32 and later, NetScaler ADC/Gateway 13.1-63.21 and later, NetScaler ADC 14.1-FIPS 14.1-73.32 FIPS and later, NetScaler ADC 13.1-FIPS/NDcPP 13.1-37.277 and later. After upgrade, `show version` should report NS14.1: Build 73.33.nc or higher, or NS13.1: Build 63.21.nc or higher.

Impact Assessment

NetScaler is the choke point of the enterprise DMZ and remote-work VPN path. CVE-2026-19490 is not an info leak or single-state bypass. It grants administrator-level sessions. First login can read/write vServer config, add custom SAML assertions, redirect VPN users to a phishing portal, or inject LDAPS/RADIUS delegation. F5 Labs' 19 August 2026 Weekly Threat Bulletin flags network-edge devices as 22% of vulnerability exploitation in 2025 Verizon DBIR data, with 29% of edge-device vulns showing observable exploitation on public-disclosure day. Once CVE-2026-19490 lands in Exploit-DB, Packet Storm, or a GitHub PoC, time-to-weaponization may be hours. CVSS v4.0 9.3 is stacked high Confidentiality + high Integrity + high Availability — not the typical mid-severity missing-auth profile.

CVE-2026-19489 looks like memory overflow plus service interruption. When the LSN SIP ALG box is also the enterprise VoIP SBC egress, inbound UC contact center, or NAT anchor for remote video interviews, a malformed SIP INVITE can saturate it remotely. The vendor alert does not rule out chaining CVE-2026-19489 with CVE-2026-19490, especially on 14.1-43.55 and earlier where both coexist: unauthenticated attacker obtains admin via CVE-2026-19490, then triggers CVE-2026-19489 to force a maintenance window. Given the credential-compromise skeleton from CitrixBleed 1/2 over three years, run upgrade, credential rotation, and session revocation in parallel.

Remediation

• Upgrade immediately: move all Internet-facing or DMZ NetScaler ADC/Gateway appliances to 14.1-73.32 (or later) or 13.1-63.21 (or later). FIPS/NDcPP and Hybrid mode follow the bulletin table. Backup `ns.conf` and current license files before upgrade.

• Triage preconditions: use CERT-EU keywords `add authentication samlAction.*`, `add authentication vserver .*`, `add vpn vserver .*`, `add lsn group.*sipalg.*` against current config. Confirm whether this CVE requires incident response. Mark upgraded nodes in documentation.

• Credential and session rotation: after upgrade, force-invalidate all active sessions (`kill all lb vserver`, `clear vpn session`, etc.) and rotate passwords for all local and service accounts that authenticate through NetScaler. When LDAP/RADIUS/CAS is in use, refresh shared secrets and token-signing certificates.

• Inbound access reduction: before the patch window, temporarily restrict 443/TCP, 1494/TCP, 2598/TCP and other Gateway ports to the smallest IP range. Avoid scans from unpublished exploit tooling while the patch is not live. Enable NetScaler App Firewall AAA and SAML strict mode to shrink default attack surface.

• SIP ALG: if LSN SIP ALG is VoIP-only, disable SIP ALG immediately on production-edge devices with no VoIP workload. Segments that must keep it: upgrade per vendor guidance and add DPI/WAF at the SIP edge.

• Detection and logs: ingest NetScaler AAA, SAML, VPN, and LSN logs into SIEM. Alert on anomalous SAML responses, unexpected vServer creation, and unauthorized AAA config changes. Correlate time sync, anomalous credential use, and SAML assertion signature validation between NetScaler and the upstream AAA IdP.

References

• CERT-EU Security Advisory 2026-010: Citrix NetScaler ADC and Gateway

• Canadian Centre for Cyber Security AV26-833: Citrix NetScaler security advisory

• ZeroDay News: CVE-2026-19490 Critical NetScaler Authentication Bypass details

• CyFAR: Security Advisory 2026-010 CISO Brief and Attack Chain