Citrix urges admins to patch new NetScaler flaws as soon as possible
Citrix has warned customers to immediately secure their systems against two vulnerabilities affecting NetScaler Gateway secure remote access solutions and NetScaler ADC networking appliances.
Intelligence analysis by Llama
Citrix has warned customers to patch two new NetScaler vulnerabilities, one of which can allow remote attackers to bypass authentication, and the other can be abused in denial-of-service attacks.
Imagine you have a special key to unlock a door. But someone else finds out what the key looks like and can make a copy of it. That's what's happening with the Citrix NetScaler vulnerabilities. Hackers can find out how to make a copy of the key and use it to get into the system. Citrix is telling people to change the lock so that the copied key won't work.
Analysis
Citrix NetScaler Vulnerabilities: A Detailed Analysis
Citrix has warned customers to immediately secure their systems against two vulnerabilities affecting NetScaler Gateway secure remote access solutions and NetScaler ADC networking appliances. The most severe of the two, tracked as CVE-2026-19490, can allow remote attackers without privileges to bypass authentication when the appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy), depending on the NetScaler firmware version and whether SAML Action is configured.
Admins can check if an appliance is vulnerable to attacks targeting CVE-2026-19490 by inspecting their NetScaler configuration for SAML action configuration (add authentication samlAction.) string and Auth or VPN vserver ('add authentication vserver.' and 'add vpn vserver.*') strings.
The second, a high-severity memory overflow security flaw tracked as CVE-2026-19489, can be abused by remote unauthenticated threat actors in denial-of-service (DoS) attacks when SIP ALG (Session Initiation Protocol Application Layer Gateway) is enabled on a large-scale NAT group configuration.
Security teams can determine whether Citrix NetScaler appliances on their network meet the preconditions for CVE-2026-19489 exploitation by inspecting their configuration for the 'add lsn group.sipalg.' string.
Citrix advised customers to upgrade vulnerable NetScaler ADC and NetScaler Gateway appliances to: NetScaler ADC and NetScaler Gateway 14.1-73.32 or later, NetScaler ADC and NetScaler Gateway 13.1-63.21 or later, NetScaler ADC FIPS 14.1-73.32 FIPS or later, or NetScaler ADC FIPS and NDcPP 13.1-37.277 or later, as applicable.
While these security flaws have not been flagged as exploited in attacks, Citrix urged admins to patch two other NetScaler vulnerabilities (CVE-2026-3055 and CVE-2026-4368) on March 23, just days before attackers began abusing them in the wild.
CISA added the CVE-2026-3055 vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on March 30 and ordered federal agencies to secure vulnerable Citrix appliances within three days.
Over the last five years, the U.S. cybersecurity agency has flagged 22 Citrix vulnerabilities as exploited in the wild, six of them also abused in ransomware attacks.
The ShadowServer Foundation now tracks over 22,000 NetScaler ADC and nearly 1,800 NetScaler Gateway instances exposed online.
However, it does not provide information on the number of honeypots or how many may be vulnerable to attacks targeting CVE-2026-19489 and CVE-2026-19490.
Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access.
Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report
Key points
- Citrix has warned customers to patch two new NetScaler vulnerabilities.
- The most severe vulnerability, CVE-2026-19490, can allow remote attackers to bypass authentication.
- The second vulnerability, CVE-2026-19489, can be abused in denial-of-service attacks.
- Citrix has advised customers to upgrade vulnerable NetScaler ADC and NetScaler Gateway appliances.
- CISA has added the CVE-2026-3055 vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog.
Citrix has warned customers to patch the vulnerabilities, and security teams can determine whether their appliances are vulnerable by inspecting their configuration. This means that admins can take proactive steps to secure their systems and prevent potential attacks.
The vulnerabilities can be abused in denial-of-service attacks, and once attackers have valid credentials, only 37% of their actions are blocked. This means that even if admins patch the vulnerabilities, there is still a risk of attacks.
