Critical Citrix NetScaler Vulnerabilities Demand Immediate Patching
On 19 August 2026, Citrix disclosed two vulnerabilities affecting its NetScaler ADC and NetScaler Gateway devices, with one posing a severe risk to enterprise networks. The flaws, tracked as CVE-2026-19489 (CVSS 8.8) and CVE-2026-19490 (CVSS 9.3), could enable denial-of-service attacks and authentication bypass, respectively.
CVE-2026-19490, the more critical of the two, allows attackers to bypass authentication on exposed systems. Given that NetScaler ADC and Gateway are widely used for application delivery, load balancing, SSL/TLS offloading, and secure remote access, they are often deployed in enterprise DMZs, making them prime targets for exploitation. Security firm Rapid7 warned that such vulnerabilities in Citrix products are frequently weaponized by threat actors.
Affected versions include:
- NetScaler ADC & Gateway 14.1 (before 14.1-73.32)
- NetScaler ADC & Gateway 13.1 (before 13.1-63.21)
- NetScaler ADC FIPS (before 14.1-73.32 FIPS or 13.1-37.277 for NDcPP)
Citrix provided detection guidance, advising customers to check for SAML action configurations (add authentication samlAction.*) or authentication/VPN vserver setups (add authentication vserver .* / add vpn vserver .*).
While no active exploitation has been observed as of the disclosure date, Rapid7 emphasized the urgency of patching, noting that Citrix vulnerabilities historically attract rapid attacker interest. Organizations are advised to apply updates immediately to mitigate potential risks.
Citrix cybersecurity rating report: https://www.rankiteo.com/company/citrix
"id": "CIT1787610269",
"linkid": "citrix",
"type": "Vulnerability",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Enterprises using NetScaler ADC '
'and Gateway',
'industry': 'Information Technology',
'name': 'Citrix',
'type': 'Technology Vendor'}],
'attack_vector': 'Authentication Bypass, Denial-of-Service',
'customer_advisories': 'Immediate patching recommended for affected versions.',
'date_detected': '2026-08-19',
'date_publicly_disclosed': '2026-08-19',
'description': 'Citrix disclosed two vulnerabilities affecting its NetScaler '
'ADC and NetScaler Gateway devices, with one posing a severe '
'risk to enterprise networks. The flaws, tracked as '
'CVE-2026-19489 (CVSS 8.8) and CVE-2026-19490 (CVSS 9.3), '
'could enable denial-of-service attacks and authentication '
'bypass, respectively. CVE-2026-19490 allows attackers to '
'bypass authentication on exposed systems, which are widely '
'used for application delivery, load balancing, SSL/TLS '
'offloading, and secure remote access.',
'impact': {'operational_impact': 'Potential unauthorized access, '
'denial-of-service',
'systems_affected': 'NetScaler ADC and NetScaler Gateway devices'},
'investigation_status': 'Ongoing (no active exploitation observed as of '
'disclosure)',
'post_incident_analysis': {'corrective_actions': 'Patching and updating '
'affected systems',
'root_causes': 'Software vulnerabilities in '
'NetScaler ADC and Gateway'},
'recommendations': 'Organizations are advised to apply updates immediately to '
'mitigate potential risks.',
'references': [{'source': 'Citrix'}, {'source': 'Rapid7'}],
'response': {'communication_strategy': 'Public disclosure and advisories',
'containment_measures': 'Patching guidance provided',
'remediation_measures': 'Apply updates to affected versions',
'third_party_assistance': 'Rapid7'},
'stakeholder_advisories': 'Detection guidance provided for SAML action '
'configurations and authentication/VPN vserver '
'setups.',
'title': 'Critical Citrix NetScaler Vulnerabilities Demand Immediate Patching',
'type': 'Vulnerability Disclosure',
'vulnerability_exploited': ['CVE-2026-19489', 'CVE-2026-19490']}