Citrix has patched a critical authentication bypass in NetScaler ADC and NetScaler Gateway, and Rapid7 expects attackers to weaponize it quickly.
The flaw, tracked as CVE-2026-19490 with a CVSS score of 9.3, is an authentication bypass using an alternative path. It affects appliances configured as a gateway, covering SSL VPN, ICA Proxy, CVPN, and RDP Proxy roles, as well as AAA virtual servers. Remote, unauthenticated attackers can exploit it without any user interaction.
A second issue, CVE-2026-19489, is a high-severity memory overflow that can cause unexpected behavior or denial of service when SIP ALG is enabled at an LSN group configuration.
Affected versions include NetScaler ADC and Gateway 14.1-43.55 and earlier, 13.1-61.27 and earlier, plus later 14.1-43.56, 14.1-66.68-FIPS, and 13.1-61.28 builds. Fixes ship in 14.1-73.32 and 13.1-63.21, with FIPS and NDcPP variants covered. Secure Private Access Hybrid deployments running NetScaler instances are also exposed.
Rapid7 says there are no signs of in-the-wild exploitation yet, but NetScaler appliances typically sit in enterprise DMZs and are publicly reachable, making them prime targets. The firm urges emergency patching, noting that NetScaler gear is a high-value target that historically draws exploitation soon after disclosure.
