Citrix Releases Security Updates for NetScaler ADC and NetScaler Gateway

CVE-2026-19490 could allow a remote unauthenticated attacker to bypass authentication

Threat ID:: CC-4834
Threat Severity:: Medium
Published:: 19 August 2026 2:20 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

CVE-2026-19490 could allow a remote unauthenticated attacker to bypass authentication

Affected platforms

The following platforms are known to be affected:

NetScaler ADC

Versions:

14.1  prior to 14.1-73.32
13.1  prior to 13.1-63.21
FIPS prior to 14.1-73.32 FIPS
FIPS and NDcPP prior to 13.1-37.277

NetScaler Gateway

Versions:

14.1  prior to 14.1-73.32
13.1  prior to 13.1-63.21

Threat details

Introduction

Citrix published a security advisory addressing two vulnerabilities in NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway). Successful exploitation of CVE-2026-19490 could allow a remote unauthenticated attacker to bypass authentication and CVE-2026-19489 could lead to unpredictable behaviour or denial of service.

CVE-2026-19490 - 'Authentication Bypass Using an Alternate Path' vulnerability - CVSSv4 score of 9.3
CVE-2026-19489 - 'Improper Restriction of Operations within the Bounds of a Memory Buffer' vulnerability - CVSSv4 score of 8.8

Remediation advice

Affected organisations are strongly encouraged to review Citrix advisory CTX696939 and apply the relevant update as soon as possible.

Definitive source of threat updates

https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939&articleURL=NetScaler_ADC_and_NetScaler_Gateway_Security_Bulletin_for_CVE_2026_19489_and_CVE_2026_19490

CVE Vulnerabilities

Status Reserved

CVE-2026-19489

Status Reserved

CVE-2026-19490

Last edited: 19 August 2026 2:20 pm