CVE-2026-19489

A memory overflow in NetScaler when SIP ALG is enabled on a Large Scale NAT group, which can cause unpredictable behaviour or a denial of service.

Affects

Citrix NetScaler ADC and NetScaler Gateway (customer-managed)

Severity

High · CVSS 8.8

Fixed in

14.1-73.32 and later
13.1-63.21 and later
14.1-73.32 FIPS and later
13.1-37.277 and later (13.1-FIPS and 13.1-NDcPP)

Being used in attacks

Not known to be

Made public

9 Sept 2026

Part of: Citrix NetScaler ADC and Gateway login bypass CVE-2026-19490 used in attacks; fixed builds available

CVE-2026-19490 is an authentication bypass in Citrix NetScaler ADC and NetScaler Gateway. When an appliance is set up as a Gateway (SSL VPN, ICA Proxy, CVPN or RDP Proxy) or as an AAA virtual server, a remote attacker with no password may be able to get past the login. Citrix rates it 9.3 on CVSS v4.0 (NVD lists 9.8 on the older scale). Citrix published bulletin CTX696939 on 19 August 2026 with fixed builds 14.1-73.32, 13.1-63.21, 14.1-73.32 FIPS and 13.1-37.277, and says there are no workarounds. The same bulletin fixes CVE-2026-19489, a memory overflow that can crash the appliance when SIP ALG is enabled on a Large Scale NAT group. On 9 September CISA listed CVE-2026-19490 as being used in attacks. Citrix's bulletin made no exploitation statement when we read it, and Rapid7 had seen none as of 19 August. Citrix-managed cloud services are updated by Cloud Software Group; only customer-managed appliances need action. Cloud marketplace images had not been refreshed as of 21 August; current status is not confirmed.

Fixed in the same update

• CVE-2026-19490Login bypass in Citrix NetScaler Gateway and AAA

Sources

1. NetScaler ADC and NetScaler Gateway Security Bulletin (CTX696939)Citrix · 19 Aug 2026
2. Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490)Help Net Security · 21 Aug 2026