In a recent move to enhance network security, Citrix has rolled out updates to address significant vulnerabilities affecting NetScaler ADC and NetScaler Gateway systems. One of the flaws, possessing a critical severity level, can bypass authentication, posing a serious threat to enterprise security.
Details of the Vulnerabilities
The vulnerabilities impact customer-managed instances of NetScaler ADC and NetScaler Gateway, including specific FIPS and NDcPP builds. SecurAccess ZTNA Hybrid deployments that utilize these customer-managed instances are also affected. However, Citrix-managed cloud services and Adaptive Authentication are not impacted as they have already integrated the necessary updates.
The versions of NetScaler affected are outlined as follows: NetScaler ADC and Gateway versions predating 14.1-73.32 and 13.1-63.21, as well as certain FIPS and NDcPP configurations. The primary concern is CVE-2026-19490, an authentication bypass vulnerability with a CVSS score of 9.3, affecting systems configured with Gateway or AAA virtual servers under specific conditions.
Understanding the Threats
CVE-2026-19489, another vulnerability with a CVSS score of 8.8, is a memory overflow issue that could lead to unpredictable behavior or a denial-of-service (DoS) condition. This flaw is triggered when the Session Initiation Protocol Application Layer Gateway (SIP ALG) is active on a Large Scale NAT (LSN) group setup.
For CVE-2026-19490, the risk arises in configurations utilizing a SAML action or when set up as a Gateway or AAA vserver. Citrix advises organizations to assess their configurations to determine if they are susceptible to these vulnerabilities.
Mitigation and Future Outlook
Citrix recommends using features like Global Deny Lists available in NetScaler Console to mitigate these risks. This feature, activated by default in newer firmware versions, helps apply security signatures automatically to managed appliances.
The security updates are now available in versions 14.1-73.32 and 13.1-63.21 or later for both standard and FIPS versions. Credit for identifying these vulnerabilities goes to security researcher Samarth Vashisht from JPMorgan Chase’s pen-test team. Despite no current evidence of exploitation in the wild, Citrix vulnerabilities remain a prime target for attackers, as evidenced by recent incidents.
As cyber threats evolve, timely updates and vigilant configuration reviews remain critical in safeguarding enterprise networks against potential breaches.
