AL26-019 - Vulnerabilities impacting Citrix NetScaler ADC and NetScaler Gateway - CVE-2026-19490 and CVE-2026-19489 - Update 1

Number: AL26-019 Date: September 4, 2026 Updated: September 9, 2026 Audience This Alert is intended for IT professionals and managers. Purpose An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security ("Cyber Centre") is also available to provide additional assistance regarding the content of this Alert to recipients as requested. Details The Cyber Centre is aware of vulnerabilities impacting NetScaler ADC (formerly Citrix ADC) and NetScaler Gateway (formerly Citrix Gateway) Footnote 1 . In response to the vendor advisory released on August 19, 2026, the Cyber Centre released AV26-833 on August 19, 2026 Footnote 2 . Tracked as CVE-2026-19490 Footnote 3 , this vulnerability is an Authentication Bypass Using an Alternate Path vulnerability (CWE-288) Footnote 4 . The vulnerability may allow a remote, unauthenticated attacker to circumvent authentication controls on NetScaler appliances configured as a Gateway for SSL VPN, ICA Proxy, CVPN, or RDP Proxy, or as an AAA virtual server. Tracked as CVE-2026-19489 Footnote 5 , this vulnerability is a Classic Buffer Overflow vulnerability (CWE-120) Footnote 6 . This vulnerability may allow memory overflow leading to unpredictable behavior or Denial of Service conditions. Pre-conditions for these vulnerabilities are that the NetScaler ADC or NetScaler Gateway 14.1-43.56 and later, as well as 13.1-61.28 and later, must be configured as a SAML IdP (Security Assertion Markup Language Identity Provider). Earlier builds with Gateway or AAA configuration are also vulnerable. To determine if organizations are impacted, it is recommended to check if the appliance meets the precondition by inspecting the NetScaler configuration for the specified strings: For CVE-2026-19489: " add lsn group.*sipalg.* " For CVE-2026-19490: SAML action configuration: " add authentication sa