Multiple vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway products

NetScaler ADC is a networking controller designed to improve application performance, security, and resiliency. As for NetScaler Gateway, it is an access gateway offering remote access services to network resources. These products are affected by the vulnerabilities labeled as follows: CVE-2026-19489 (CVSS 8.8): Memory overflow vulnerability due to improper restriction of operations within the bounds of a memory buffer, potentially leading to unpredictable behavior or denial of service. This vulnerability concerns devices on which SIP ALG is activated within a Large Scale NAT (LSN) configuration; CVE-2026-19490 (CVSS 9.3): Alternative path authentication bypass vulnerability, allowing a remote, unauthenticated attacker to bypass authentication mechanisms. Operation concerns in particular equipment configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server. For some versions, SAML configuration is also required.

• Citrix NetScaler ADC and NetScaler Gateway products running:;
• Versions 14.1 prior to 14.1-73.32;
• Versions 13.1 prior to 13.1-63.21;
• NetScaler ADC FIPS before 14.1-73.32;
• NetScaler ADC FIPS and NDcPP before 13.1-37.277;
• Secure Private Access Hybrid deployments using NetScaler instances are also affected;