Source: Cyber Security News
Author: Guru Baran
URL: https://cybersecuritynews.com/critical-citrix-netscaler-vulnerability/
ONE SENTENCE SUMMARY:
Two critical NetScaler vulnerabilities enable authentication bypass or denial-of-service, demanding immediate upgrades and configuration checks across affected versions.
MAIN POINTS:
- Cloud Software Group disclosed two severe flaws in NetScaler ADC and NetScaler Gateway.
- CVE-2026-19490 enables authentication bypass in Gateway/AAA virtual server deployments.
- Severity is high: CVSS v4.0 9.3, mapped to CWE-288 alternate-path authentication bypass.
- Later builds are exploitable only when a SAML action is configured.
- Earlier builds are broadly exposed with any Gateway or AAA vserver configuration.
- CVE-2026-19489 is a memory overflow causing instability or denial-of-service outages.
- Denial-of-service trigger requires SIP ALG enabled within a Large Scale NAT group.
- Affected releases include 14.1 before 73.32 and 13.1 before 63.21, plus FIPS/NDcPP variants.
- Secure Private Access Hybrid customer-managed NetScaler instances also need the same upgrades.
- Admins can assess exposure by searching configuration files for SAML, vserver, LSN, and SIP ALG entries.
TAKEAWAYS:
- Prioritize patching immediately due to network-facing exposure and low exploitation complexity.
- Upgrade to 14.1-73.32+ or 13.1-63.21+ (including matching FIPS/NDcPP builds).
- Treat authentication-bypass risk as potential credentialless network entry via remote access gateways.
- Mitigate DoS risk by identifying LSN groups using SIP ALG and planning rapid remediation.
- Expect increased opportunistic scanning and targeted exploitation once public details spread.