Ethical Hacking News
A critical security flaw in the NetScaler ADC and NetScaler Gateway deployments has been discovered, allowing attackers to bypass authentication on certain gateway and AAA servers. The vulnerability, discovered by Samarth Vashisht from the pen-test team at JPMorgan Chase, has been rated as high-severity by Citrix, the company responsible for NetScaler. The update addresses a critical-severity authentication bypass vulnerability that affects customer-managed NetScaler ADC and NetScaler Gateway deployments. To protect their systems, customers are advised to prioritize updates and apply the necessary patches as soon as possible.
A critical security flaw in NetScaler ADC and NetScaler Gateway deployments has been discovered, allowing attackers to bypass authentication. The vulnerability affects customer-managed deployments, including FIPS and NDcPP builds, and SecurAccess ZTNA Hybrid deployments. Two vulnerabilities have been identified: CVE-2026-19489 (memory overflow) and CVE-2026-19490 (authentication bypass). Updates are available to address both vulnerabilities, with priority advised based on exposure, deployment role, and configuration. Customers can check their device's configuration for specific strings to determine if they are affected. Mitigation can be achieved by using signatures in firmware versions 14.1-60.52 and 13.1-63.16 or higher.
A critical security flaw in the NetScaler ADC and NetScaler Gateway deployments has been discovered, allowing attackers to bypass authentication on certain gateway and AAA servers. The vulnerability, discovered by Samarth Vashisht from the pen-test team at JPMorgan Chase, has been rated as high-severity by Citrix, the company responsible for NetScaler.
According to Citrix, the issue affects customer-managed NetScaler ADC and NetScaler Gateway deployments, including certain FIPS and NDcPP builds, as well as SecurAccess ZTNA Hybrid deployments that use customer-managed NetScaler instances. The vulnerability does not apply to Citrix-managed cloud services or Citrix-managed Adaptive Authentication, as the necessary updates have already been applied.
The first of the two vulnerabilities is CVE-2026-19489, a memory overflow vulnerability that may lead to unpredictable behavior or denial-of-service (DoS). However, it applies only when Session Initiation Protocol Application Layer Gateway (SIP ALG) is enabled on a Large Scale NAT (LSN) group configuration. The more severe of the two vulnerabilities is CVE-2026-19490, an authentication bypass vulnerability that affects appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or an AAA virtual server.
Citrix has released updates to address both vulnerabilities, and customers are advised to prioritize updates based on exposure, deployment role, and whether the affected configuration is enabled. The updates are available in the following versions:
- NetScaler ADC and NetScaler Gateway 14.1-73.32 or later
- NetScaler ADC and NetScaler Gateway 13.1-63.21 or later
- NetScaler ADC FIPS 14.1-73.32 FIPS or later
- NetScaler ADC FIPS and NDcPP 13.1-37.277 or later
Customers can check if their device meets the precondition for CVE-2026-19489 by inspecting their NetScaler configuration for the specified string "add lsn group.*sipalg*". For CVE-2026-19490, customers can verify their NetScaler configuration for the string "add authentication samlAction.*" or "add authentication vserver .*" or "add vpn vserver .*".
Additionally, Citrix has noted that the vulnerability can be mitigated by using signatures if the NetScaler firmware version is higher than 14.1-60.52 and 13.1-63.16 or higher, which have a feature called Global Deny Lists that consumes the signatures and automatically applies the signatures to NetScaler appliances managed via NetScaler Console.
The updates are part of a broader effort by Citrix to address several security vulnerabilities in the NetScaler ADC and Gateway deployments. Last month, an insufficient input validation vulnerability in NetScaler ADC and NetScaler Gateway (CVE-2026-8451) was discovered, and it has been reported that this vulnerability has been actively exploited.
The discovery of the new vulnerability highlights the ongoing threat landscape in the enterprise security space, where companies must remain vigilant in monitoring their systems for potential security breaches. With the increasing adoption of cloud and virtualization technologies, the importance of robust security measures has become more critical than ever.
Related Information:
https://www.ethicalhackingnews.com/articles/Critical-NetScaler-Flaw-Exposed-A-Threat-to-Enterprise-Security-ehn.shtml
https://thehackernews.com/2026/08/critical-netscaler-flaw-can-bypass.html
https://nvd.nist.gov/vuln/detail/CVE-2026-19489
https://www.cvedetails.com/cve/CVE-2026-19489/
https://nvd.nist.gov/vuln/detail/CVE-2026-19490
https://www.cvedetails.com/cve/CVE-2026-19490/
Published: Thu Aug 20 10:54:52 2026 by llama3.2 3B Q4_K_M
