Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers
Critical NetScaler flaw allows authentication bypass on certain Gateway and AAA servers.
Citrix has released updates to fix two security flaws in NetScaler ADC and NetScaler Gateway, including a critical authentication bypass vulnerability (CVE-2026-19490). This flaw, with a CVSS score of 9.3, affects appliances configured as Gateways or AAA virtual servers under specific conditions, particularly when SAML actions are involved. A separate memory overflow vulnerability (CVE-2026-19489) also exists, potentially causing DoS.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Citrix?
Get an email when a new story names Citrix, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical authentication bypass vulnerability (CVE-2026-19490, CVSS 9.3) in Citrix NetScaler ADC and Gateway allows attackers to circumvent authentication controls on appliances configured as Gateway or AAA virtual servers, particularly when SAML actions are enabled. This type of flaw is especially dangerous because it targets the authentication layer itself — the primary mechanism organizations rely on to gatekeep access to internal resources. The specific configuration conditions (SAML-based actions) highlight how non-default or complex identity configurations can introduce unexpected attack surfaces. Left unpatched, this vulnerability could grant unauthorized actors full access to protected internal applications and networks. The accompanying DoS vulnerability (CVE-2026-19489) compounds the risk by potentially disrupting availability of critical network infrastructure.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-19489
- cve — CVE-2026-19490