Citrix NetScaler CVE-2026-19490 and CVE-2026-19489: critical auth bypass and DoS

Two flaws affect Citrix NetScaler ADC and Gateway: critical authentication bypass CVE-2026-19490 and high-severity buffer overrun CVE-2026-19489 causing denial of service. The bypass applies to appliances in Gateway, SSL VPN, ICA Proxy, CVPN, RDP Proxy or AAA roles; the DoS requires SIP ALG enabled for LSN. No workaround exists, only the security update.

• CVE-2026-19490 is a critical auth bypass on exposed NetScaler appliances
• CVE-2026-19489 is a buffer overrun causing DoS with SIP ALG for LSN
• ZoomEye counted 239,670 Citrix NetScaler instances online
• No workaround exists; applying the security update is the only fix