Critical Net Scaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers
Summary: Citrix released updates for two NetScaler ADC and NetScaler Gateway flaws, including CVE-2026-19490 (CVSS 9.3), an authentication bypass affecting appliances configured as a Gateway or AAA virtual server, and CVE-2026-19489 (CVSS 8.8), a memory overflow that applies only when SIP ALG is enabled on an LSN group. Citrix credited Samarth Vashisht of JPMorgan Chase's pen-test team for reporting the flaws, and Previdian reported 10 exploitation attempts against CVE-2026-19490 from six unique IP addresses in Australia, Germany, Japan, and the U.S.
Bottom line: Previdian observed exploitation attempts against CVE-2026-19490 as of September 3, and a separate NetScaler flaw, CVE-2026-8451, saw active exploitation less than 24 hours after public disclosure last month.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-19489CVE-2026-19490CVE-2026-8451
- Related
- CVE-2026-19490: Citrix Net Scaler Authentication Bypass Using an Alternate Path or Channel Vulnerability Known Exploited Vulnerabilities · Sep 09, 2026