Citrix has issued urgent security patches for a critical authentication bypass vulnerability in NetScaler ADC and NetScaler Gateway, designated as CVE-2026-19490.
The critical vulnerability carries a CVSS v4.0 score of 9.3 and enables an authenticated or unauthenticated attacker to bypass login checks using an alternate path under specific gateway or virtual server configurations. According to Anil Shetty, senior vice president of engineering at Cloud Software Group, the bulletin impacts supported customer-managed NetScaler ADC and NetScaler Gateway deployments, including specific FIPS and NDcPP builds, alongside SecurAccess ZTNA Hybrid implementations that rely on customer-managed NetScaler instances.
“We strongly recommend that customers review the official NetScaler ADC and NetScaler Gateway security bulletin, assess whether their deployments are affected, and upgrade impacted appliances to the recommended builds as soon as possible,” stated Shetty.
While Rapid7 confirmed that active exploitation of CVE-2026-19490 had not been observed as of August 19, 2026, security researchers advise organizations to prioritize emergency patching due to the high likelihood of rapid weaponization once technical details circulate. Administrators can verify preconditions by inspecting configurations for specific SAML actions, authentication virtual servers, or VPN virtual servers.
Alongside the primary authentication flaw, Citrix patched a secondary memory overflow vulnerability tracked as CVE-2026-19489. Carrying a CVSS v4.0 score of 8.8, this denial-of-service vector impacts systems running Large Scale NAT groups with SIP ALG enabled. Affected software versions include NetScaler ADC and Gateway 14.1 prior to build 14.1-73.32, version 13.1 prior to 13.1-63.21, as well as specific FIPS and NDcPP iterations.
“Once you upgrade a NetScaler in an ICA proxy setup to version 14.1-72.16 (or 13.1-63.18) or later, any ICA session that attempts to reconnect using a session ticket issued by the older (pre-upgrade) version is dropped,” Shetty explained, noting that users must initiate new sessions following the upgrade.