Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers
- ID
- 16091
- Status
- summarized
- Published
- 20 Aug 2026, 9:35 PM
- Fetched
- 20 Aug 2026, 11:45 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/critical-netscaler-flaw-can-bypass.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 3.0
- Created
- 20 Aug 2026, 11:48 PM
- Tags
- Audience
- developers
What happened
Citrix patched two NetScaler flaws, including CVE-2026-19490 (CVSS 9.3), an authentication bypass affecting customer-managed NetScaler ADC and Gateway appliances configured as SSL VPN, ICA Proxy, CVPN, RDP Proxy, or AAA virtual servers. The bypass has version-specific triggers—some versions require a SAML action to be configured, while earlier 14.1 and 13.1 builds are vulnerable regardless. A second flaw, CVE-2026-19489 (CVSS 8.8), is a memory overflow that only triggers when SIP ALG is enabled on an LSN group.
Why it matters
If your organization runs customer-managed NetScaler ADC or Gateway for VPN or AAA, check whether you are on a vulnerable build (pre-14.1-73.32 or pre-13.1-63.21) and patch immediately—authentication bypass on a VPN gateway is directly exploitable. Most SaaS founders and developers not running NetScaler can ignore this.
Discussion angle
Whether your infra or IT team still depends on NetScaler for VPN access, and how quickly legacy enterprise network gear like this gets patched in practice versus cloud-managed alternatives.