NCSC-2026-0318 [1.00] [M/M] Vulnerabilities resolved in Citrix NetScaler ADC and NetScaler Gateway

unknownCVE-2026-19489 CVE-2026-19490

Citrix has resolved vulnerabilities in NetScaler ADC and NetScaler Gateway. The vulnerability identified as CVE-2026-19489 concerns a memory overflow in NetScaler ADC and NetScaler Gateway when the products are configured as SIP ALG within a Large Scale NAT (LSN) group. This error in memory allocation can lead to unpredictable behavior or a denial of service, disrupting normal system operation. The vulnerability identified as CVE-2026-19490 allows an attacker to bypass normal authentication mechanisms via an alternative route in order to obtain unauthorized access to the system. To be vulnerable, the products must be configured in combination with specific versions as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy), AAA virtual server or configured as SAML Identity Provider. The latter is not a common configuration.

CSIRTS triage

vendor: Citrix product: NetScaler ADC and NetScaler Gateway Denial of service Authentication bypass

What: Memory overflow in SIP ALG with LSN group configuration causing DoS, and authentication bypass via alternative route for Gateway, AAA, or SAML configurations.
Who is affected: NetScaler ADC and Gateway deployments configured as SIP ALG with LSN, or as VPN/ICA Proxy/SAML Identity Provider.
Urgency: Medium priority; memory overflow causes denial of service; authentication bypass affects secure access control in specific configurations.
Action: Apply Citrix patches addressing CVE-2026-19489 and CVE-2026-19490 to affected NetScaler versions.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch NetScaler ADC and NetScaler Gateway

Get an email when a new NetScaler ADC and NetScaler Gateway advisory drops — max one per day, one-click unsubscribe.

Details

Source: NCSC-NL Advisories (NL · national-cert · site)
Severity: unknown
Published: 2026-08-20
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0318

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-194890.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-194900.33% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 26% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-19489	coverage & exploitation status	NVD · CVE.org
CVE-2026-19490	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.