Cloud Software Group has released a critical alert regarding two severe vulnerabilities in its NetScaler ADC and Gateway products. These flaws, identified as CVE-2026-19489 and CVE-2026-19490, could allow attackers to bypass authentication or cause denial-of-service conditions in unpatched systems, posing a high risk to enterprise remote access infrastructures.
Understanding the Critical Risks
The more severe vulnerability, CVE-2026-19490, holds a CVSS v4.0 base score of 9.3. It is categorized under CWE-288, which involves bypassing authentication using an alternate path. This flaw can let attackers circumvent security controls on NetScaler devices set up as a Gateway for SSL VPN, ICA Proxy, CVPN, or RDP Proxy, or as an AAA virtual server. Notably, the risk depends on the software version; devices using NetScaler 14.1-43.56 and later, or 13.1-61.28 and later, are vulnerable if a SAML action is configured.
Older versions are more broadly exposed, with any Gateway or AAA vserver setup leaving systems open to attack. Since authentication gateways are critical for remote access, an exploit could grant unauthorized network entry without valid credentials, emphasizing the need for immediate updates.
Impact of the Second Vulnerability
The second flaw, CVE-2026-19489, scores 8.8 on the CVSS v4.0 scale and is related to a memory overflow issue, classified under CWE-119. This vulnerability is activated when the SIP ALG, or Session Initiation Protocol Application Layer Gateway, is enabled within a Large Scale NAT group. Such an exploit can lead to unpredictable appliance behavior or complete denial-of-service outages, disrupting essential network services.
These vulnerabilities affect NetScaler versions 14.1 before build 73.32, and 13.1 before build 63.21, including the FIPS and NDcPP variants. Secure Private Access Hybrid deployments using customer-managed instances are also at risk and require similar upgrades.
Mitigation and Response
Administrators can assess their vulnerability by reviewing NetScaler configuration files for specific command strings. For CVE-2026-19489, identifying LSN group entries with SIP ALG settings is essential. For CVE-2026-19490, checking for SAML action configurations or authentication and VPN vserver entries is advised.
Cloud Software Group strongly recommends upgrading to NetScaler ADC and Gateway 14.1-73.32 or later, and 13.1-63.21 or later, or corresponding FIPS and NDcPP versions. Given the ease of exploitation, security teams should prioritize patching over routine maintenance tasks.
The vulnerabilities were responsibly disclosed by Samarth Vashisht from JPMorgan Chase’s penetration testing team, highlighting the importance of coordinated vulnerability research in safeguarding enterprise infrastructure. Organizations using affected versions should brace for potential targeted scanning as technical details become widely available, a scenario seen with past Citrix vulnerabilities.
