# CVE-2026-19490 — Critical Authentication Bypass in Citrix NetScaler ADC and Gateway (CVSS 9.3) with Accompanying CVE-2026-19489 Memory Overflow (CVSS 8.8)

> Two critical vulnerabilities disclosed August 19, 2026 in Citrix NetScaler ADC and NetScaler Gateway: CVE-2026-19490 (CVSS 9.3) is an unauthenticated remote authentication bypass via alternate path (CWE-288) affecting appliances configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, allowing full compromise of confidentiality, integrity, and availability. CVE-2026-19489 (CVSS 8.8) is a memory overflow (CWE-119) enabling remote unauthenticated DoS when SIP ALG is enabled on LSN configurations. Cloud Software Group released patches across all affected build lines. Neither vulnerability has confirmed active exploitation as of August 20, 2026, but Citrix has a well-documented history of rapid weaponization — 22 prior Citrix CVEs on CISA KEV, 6 abused in ransomware attacks.

- **Published:** 2026-08-20T00:00:00Z
- **Last reviewed:** 2026-09-28T17:21:55.568Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2080
- **ID:** TL-2026-2080
- **Severity:** CRITICAL (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 53 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-19490, CVE-2026-19489

## Description

On August 19, 2026, Cloud Software Group (Citrix) published security bulletin CTX696939 disclosing two vulnerabilities affecting NetScaler ADC and NetScaler Gateway appliances.

CVE-2026-19490 (CVSS 9.3, Critical) — Authentication Bypass via Alternate Path
Discovered by Samarth Vashisht of JPMorgan Chase's penetration-testing team, this flaw allows a remote, unauthenticated attacker to circumvent authentication controls on vulnerable NetScaler appliances. The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) — meaning the request handler has multiple code paths for processing incoming authentication requests, and one or more of these paths either fails to invoke the authentication verification routine or invokes it with attacker-controlled parameters that short-circuit the check. This is not a SAML assertion forgery or signature bypass; it is a routing/path confusion issue where the NetScaler treats the request as authenticated and grants access to the protected virtual server (SSL VPN portal, ICA Proxy, CVPN, RDP Proxy).

Preconditions vary by build version. On builds 14.1-43.56+ and 13.1-61.28+, both a configured SAML action AND a Gateway/AAA vserver are required. On earlier builds (14.1-43.55 and earlier, 13.1-61.27 and earlier, and all 13.1-FIPS), any Gateway or AAA virtual server configuration is sufficient — no SAML required. The CISA-ADP SSVC assessment rates the vulnerability Automatable (yes) with Technical Impact (total), meaning it can be reliably automated for full compromise.

CVE-2026-19489 (CVSS 8.8, High) — Memory Overflow
A separate memory overflow (CWE-119/CWE-120) in the SIP Application Layer Gateway (ALG) feature when configured within a Large Scale NAT (LSN) group. The attacker can trigger unpredictable behavior or denial of service remotely without authentication. Requires the presence of SIP ALG in the configuration (detectable via 'add lsn group.*sipalg.*'). The CISA-ADP assessment rates it Automatable (yes) with Technical Impact (partial), meaning automated exploitation produces partial availability loss.

Both vulnerabilities affect NetScaler ADC and Gateway 14.1 before build 73.32 and 13.1 before build 63.21, including FIPS and NDcPP variants and Secure Private Access (formerly Citrix Secure Private Access) Hybrid deployments. No workarounds exist for either CVE — the only remediation path is upgrading to patched builds. Cloud Software Group's managed cloud services and Adaptive Authentication were already patched proactively.

As of publication, no active exploitation, public PoC code, or campaign-specific IOCs had been observed by Rapid7, Citrix, or CISA. However, Citrix NetScaler appliances are high-value perimeter targets: ShadowServer tracks over 22,000 NetScaler ADC and ~1,800 NetScaler Gateway instances exposed online. Citrix has a well-documented history of rapid exploitation — CISA has listed 22 Citrix CVEs as exploited in the wild over five years, with 6 of those abused in ransomware attacks. Two prior 2026 CVEs (CVE-2026-3055, CVE-2026-4368, patched March 23) were exploited within days of disclosure; CISA added CVE-2026-3055 to KEV on March 30. The historical exploitation of Citrix authentication-related vulnerabilities — including CVE-2023-3519 (CVSS 9.8, exploited as zero-day in June 2023 leading to webshell implantation, root-level access, Active Directory enumeration, and credential dumping) and CVE-2023-4966 "Citrix Bleed" (CVSS 9.4, exploited by LockBit 3.0 ransomware affiliates for session hijacking and MFA bypass starting August 2023) — establishes a clear threat pattern where NetScaler perimeter access is aggressively weaponized once public disclosure occurs.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1550 Use Alternate Authentication Material
- T1078 Valid Accounts
- T1505 Server Software Component
- T1003 OS Credential Dumping
- T1087 Account Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1059 Command and Scripting Interpreter
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1590 Gather Victim Network Information
- T1588 Obtain Capabilities
- T1595.002 Active Scanning: Vulnerability Scanning
- T1133 External Remote Services
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.006 Command and Scripting Interpreter: Python
- T1505.003 Server Software Component: Web Shell
- T1136 Create Account
- T1556 Modify Authentication Process
- T1105 Ingress Tool Transfer
- T1499.004 Endpoint Denial of Service: Application or System Exploitation
- T1592.002 Gather Victim Host Information: Software
- T1590.005 Gather Victim Network Information: IP Addresses
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1587.004 Develop Capabilities: Exploits
- T1046 Network Service Discovery
- T1021.001 Remote Services: Remote Desktop Protocol
- T1595.001 Active Scanning: Scanning IP Blocks
- T1588.005 Obtain Capabilities: Exploits
- T1211 Exploitation for Defense Evasion
- T1212 Exploitation for Credential Access
- T1606.002 Forge Web Credentials: SAML Tokens
- T1068 Exploitation for Privilege Escalation
- T1210 Exploitation of Remote Services
- T1090 Proxy
- T1071.001 Application Layer Protocol: Web Protocols
- T1053.003 Scheduled Task/Job: Cron

## Sources

- [Citrix Security Bulletin CTX696939 — NetScaler ADC and NetScaler Gateway Security Update](https://support.citrix.com/external/article/CTX696939/netscaler-adc-and-netscaler-gateway-secu.html)
- [NVD Entry — CVE-2026-19490](https://nvd.nist.gov/vuln/detail/CVE-2026-19490)
- [NVD Entry — CVE-2026-19489](https://nvd.nist.gov/vuln/detail/CVE-2026-19489)
- [Rapid7 ETR — CVE-2026-19490 Critical Vulnerability Affecting Citrix NetScaler ADC and Gateway](https://www.rapid7.com/blog/post/etr-cve-2026-19490-critical-vulnerability-affecting-citrix-netscaler-adc-and-netscaler-gateway/)
- [SOC Prime Analysis — CVE-2026-19490](https://socprime.com/blog/cve-2026-19490-analysis/)
- [BleepingComputer — Citrix Urges Admins to Patch New NetScaler Flaws ASAP](https://www.bleepingcomputer.com/news/security/citrix-urges-admins-to-patch-new-netscaler-flaws-as-soon-as-possible/)
- [eSecurity Planet — NetScaler CVE-2026-19490 Lets Attackers Bypass Authentication](https://www.esecurityplanet.com/threats/netscaler-cve-2026-19490-lets-attackers-bypass-authentication/)
- [NetScaler Console — Remediation Guide for CVE-2026-19490](https://docs.netscaler.com/en-us/netscaler-console-service/instance-advisory/remediate-vulnerabilities-cve-2026-19490)
- [NHS UK Cyber Alert CC-4834 — Citrix NetScaler Vulnerabilities](https://digital.nhs.uk/cyber-alerts/2026/cc-4834)
- [CISA AA23-201A — Threat Actors Exploiting Citrix CVE-2023-3519](https://www.cisa.gov/sites/default/files/2023-09/aa23-201a_csa_threat_actors_exploiting_citrix-cve-2023-3519_to_implant_webshells.pdf)
- [CISA AA23-325A — #StopRansomware: LockBit 3.0 Exploits CVE-2023-4966](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a)
- [Cybersecurity News — Critical Citrix NetScaler Vulnerability](https://cybersecuritynews.com/critical-citrix-netscaler-vulnerability/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2080