--- title: Citrix urges admins to patch new NetScaler flaws as soon... description: Citrix is urging administrators to immediately patch two new NetScaler vulnerabilities. CVE-2026-19490 is a critical authentication bypass affecting appliances... canonical: https://daily.dev/posts/citrix-urges-admins-to-patch-new-netscaler-flaws-as-soon-as-possible-h5woxoyzj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Citrix urges admins to patch new NetScaler flaws as soon as possible | daily.dev og:description: Citrix is urging administrators to immediately patch two new NetScaler vulnerabilities. CVE-2026-19490 is a critical authentication bypass affecting appliances... og:url: https://daily.dev/posts/citrix-urges-admins-to-patch-new-netscaler-flaws-as-soon-as-possible-h5woxoyzj og:image: https://api.daily.dev/og/posts/H5woXoYzJ.png og:image:alt: Citrix urges admins to patch new NetScaler flaws as soon as possible og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Citrix urges admins to patch new NetScaler flaws as soon as possible **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary Citrix is urging administrators to immediately patch two new NetScaler vulnerabilities. CVE-2026-19490 is a critical authentication bypass affecting appliances configured as AAA virtual servers or Gateways, depending on firmware version and SAML Action configuration. CVE-2026-19489 is a high-severity memory overflow that enables unauthenticated denial-of-service attacks when SIP ALG is enabled on large-scale NAT configurations. Citrix advises upgrading to NetScaler ADC/Gateway 14.1-73.32, 13.1-63.21, or corresponding FIPS/NDcPP builds. Neither flaw is currently known to be exploited, but Citrix has a history of vulnerabilities being weaponized within days of disclosure, including two prior CVEs added to CISA's Known Exploited Vulnerabilities catalog. Over 22,000 NetScaler ADC and nearly 1,800 Gateway instances remain exposed online. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-19490 in Citrix NetScaler and how do I check if I'm affected? CVE-2026-19490 is a critical authentication bypass in NetScaler ADC and NetScaler Gateway that lets unprivileged remote attackers bypass authentication when the appliance is configured as an AAA virtual server or Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy), depending on firmware version and SAML Action configuration. Check your config for 'add authentication samlAction' plus 'add authentication vserver' or 'add vpn vserver' strings to determine exposure. _Teams tracking NetScaler exposure can follow patch guidance like this on daily.dev as fixes land._ ### Which NetScaler ADC and Gateway versions fix CVE-2026-19490 and CVE-2026-19489? Citrix fixed both flaws in NetScaler ADC and NetScaler Gateway 14.1-73.32, 13.1-63.21, NetScaler ADC FIPS 14.1-73.32 FIPS, and NetScaler ADC FIPS and NDcPP 13.1-37.277, or later builds as applicable. Customer-managed deployments, including certain FIPS/NDcPP builds and SecurAccess ZTNA Hybrid setups using customer-managed NetScaler instances, are affected and should upgrade to these versions. _Admins mapping out NetScaler upgrade paths can track version specifics like these on daily.dev._ ### What is CVE-2026-19489 and what conditions make a NetScaler appliance vulnerable? CVE-2026-19489 is a high-severity memory overflow flaw in NetScaler ADC and Gateway that unauthenticated remote attackers can exploit for denial-of-service attacks. It requires SIP ALG (Session Initiation Protocol Application Layer Gateway) enabled on a large-scale NAT group configuration; admins can check exposure by searching their config for the string 'add lsn group.*sipalg.*'. _Security teams triaging NetScaler DoS exposure can follow advisories like this on daily.dev._ ## Similar posts on daily.dev - [CVE‑2026‑3055](https://daily.dev/posts/cve-2026-3055-agwr1jxtq) · Arctic Wolf · 0 upvotes · 0 comments - [Citrix NetScaler bug may be multiple flaws in one](https://daily.dev/posts/citrix-netscaler-bug-may-be-multiple-flaws-in-one-kggs3gauu) · The Register · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber) [View this post on daily.dev](https://daily.dev/posts/citrix-urges-admins-to-patch-new-netscaler-flaws-as-soon-as-possible-h5woxoyzj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Citrix urges admins to patch new NetScaler flaws as soon as possible","url":"https://daily.dev/posts/citrix-urges-admins-to-patch-new-netscaler-flaws-as-soon-as-possible-h5woxoyzj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/citrix-urges-admins-to-patch-new-netscaler-flaws-as-soon-as-possible-h5woxoyzj"},"datePublished":"2026-08-20T12:18:50.552Z","dateModified":"2026-08-20T18:59:29.155Z","description":"Citrix is urging administrators to immediately patch two new NetScaler vulnerabilities. CVE-2026-19490 is a critical authentication bypass affecting appliances...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3b82f7bc2a531e4ecaf7ab568cf603ef?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/3b82f7bc2a531e4ecaf7ab568cf603ef?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/citrix-urges-admins-to-patch-new-netscaler-flaws-as-soon-as-possible-h5woxoyzj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Citrix urges admins to patch new NetScaler flaws as soon as possible"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/citrix-urges-admins-to-patch-new-netscaler-flaws-as-soon-as-possible-h5woxoyzj#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-19490 in Citrix NetScaler and how do I check if I'm affected?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-19490 is a critical authentication bypass in NetScaler ADC and NetScaler Gateway that lets unprivileged remote attackers bypass authentication when the appliance is configured as an AAA virtual server or Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy), depending on firmware version and SAML Action configuration. Check your config for 'add authentication samlAction' plus 'add authentication vserver' or 'add vpn vserver' strings to determine exposure. Teams tracking NetScaler exposure can follow patch guidance like this on daily.dev as fixes land."}},{"@type":"Question","name":"Which NetScaler ADC and Gateway versions fix CVE-2026-19490 and CVE-2026-19489?","acceptedAnswer":{"@type":"Answer","text":"Citrix fixed both flaws in NetScaler ADC and NetScaler Gateway 14.1-73.32, 13.1-63.21, NetScaler ADC FIPS 14.1-73.32 FIPS, and NetScaler ADC FIPS and NDcPP 13.1-37.277, or later builds as applicable. Customer-managed deployments, including certain FIPS/NDcPP builds and SecurAccess ZTNA Hybrid setups using customer-managed NetScaler instances, are affected and should upgrade to these versions. Admins mapping out NetScaler upgrade paths can track version specifics like these on daily.dev."}},{"@type":"Question","name":"What is CVE-2026-19489 and what conditions make a NetScaler appliance vulnerable?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-19489 is a high-severity memory overflow flaw in NetScaler ADC and Gateway that unauthenticated remote attackers can exploit for denial-of-service attacks. It requires SIP ALG (Session Initiation Protocol Application Layer Gateway) enabled on a large-scale NAT group configuration; admins can check exposure by searching their config for the string 'add lsn group.*sipalg.*'. Security teams triaging NetScaler DoS exposure can follow advisories like this on daily.dev."}}]} ```